Description
A vulnerability in the web-based management interface of Cisco Email Security Appliance (ESA), Cisco Secure Email and Web Manager, and Cisco Secure Web Appliance, formerly known as Cisco Web Security Appliance (WSA), could allow an authenticated, remote attacker to retrieve sensitive information from an affected device, including user credentials. This vulnerability is due to weak enforcement of back-end authorization checks. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to obtain confidential data that is stored on the affected device.
CVSS breakdown
CVSS 3.1
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Affected products
- Cisco / Cisco Secure Email11.0.3-238 – 11.0.3-238
- Cisco / Cisco Secure Email14.2.0-620 – 14.2.0-620
- Cisco / Cisco Secure Email14.0.0-698 – 14.0.0-698
- Cisco / Cisco Secure Email12.5.0-066 – 12.5.0-066
- Cisco / Cisco Secure Email13.5.1-277 – 13.5.1-277
- Cisco / Cisco Secure Email13.0.0-392 – 13.0.0-392
- Cisco / Cisco Secure Email12.1.0-089 – 12.1.0-089
- Cisco / Cisco Secure Email12.1.0-087 – 12.1.0-087
- Cisco / Cisco Secure Email12.1.0-071 – 12.1.0-071
- Cisco / Cisco Secure Email12.0.0-419 – 12.0.0-419
- Cisco / Cisco Secure Email11.1.0-128 – 11.1.0-128
- Cisco / Cisco Secure Email11.1.0-131 – 11.1.0-131
- Cisco / Cisco Secure Email11.1.0-069 – 11.1.0-069
- Cisco / Cisco Secure Email and Web Manager14.2.0-212 – 14.2.0-212
- Cisco / Cisco Secure Email and Web Manager12.0.0-452 – 12.0.0-452
- Cisco / Cisco Secure Email and Web Manager12.0.1-011 – 12.0.1-011
- Cisco / Cisco Secure Email and Web Manager12.5.0-636 – 12.5.0-636
- Cisco / Cisco Secure Email and Web Manager12.5.0-658 – 12.5.0-658
- Cisco / Cisco Secure Email and Web Manager12.5.0-678 – 12.5.0-678
- Cisco / Cisco Secure Email and Web Manager12.5.0-670 – 12.5.0-670
- Cisco / Cisco Secure Email and Web Manager13.0.0-277 – 13.0.0-277
- Cisco / Cisco Secure Email and Web Manager13.6.2-078 – 13.6.2-078
- Cisco / Cisco Secure Email and Web Manager13.8.1-068 – 13.8.1-068
- Cisco / Cisco Secure Email and Web Manager13.8.1-074 – 13.8.1-074
- Cisco / Cisco Secure Email and Web Manager12.8.1-002 – 12.8.1-002
- Cisco / Cisco Secure Email and Web Manager14.0.0-404 – 14.0.0-404
- Cisco / Cisco Secure Email and Web Manager14.1.0-223 – 14.1.0-223
- Cisco / Cisco Secure Email and Web Manager14.1.0-227 – 14.1.0-227
- Cisco / Cisco Secure Email and Web Manager11.0.0-115 – 11.0.0-115
- Cisco / Cisco Secure Email and Web Manager11.0.1-161 – 11.0.1-161
- Cisco / Cisco Secure Email and Web Manager11.5.1-105 – 11.5.1-105
- Cisco / Cisco Secure Web Appliance12.5.1-011 – 12.5.1-011
- Cisco / Cisco Secure Web Appliance12.5.2-007 – 12.5.2-007
- Cisco / Cisco Secure Web Appliance12.0.3-007 – 12.0.3-007
- Cisco / Cisco Secure Web Appliance12.0.1-268 – 12.0.1-268
- Cisco / Cisco Secure Web Appliance11.8.3-021 – 11.8.3-021
- Cisco / Cisco Secure Web Appliance11.8.3-018 – 11.8.3-018
- Cisco / Cisco Secure Web Appliance11.8.1-023 – 11.8.1-023
- Cisco / Cisco Secure Web Appliance11.8.0-414 – 11.8.0-414
- Cisco / Cisco Secure Web Appliance11.7.2-011 – 11.7.2-011
- Cisco / Cisco Secure Web Appliance11.7.1-020 – 11.7.1-020
- Cisco / Cisco Secure Web Appliance11.7.1-006 – 11.7.1-006
- Cisco / Cisco Secure Web Appliance11.7.1-049 – 11.7.1-049
- Cisco / Cisco Secure Web Appliance11.7.0-418 – 11.7.0-418
- Cisco / Cisco Secure Web Appliance11.7.0-406 – 11.7.0-406