Lucene search

CiscoCVE-2019-1947

HistorySep 23, 2020 - 1:15 a.m.

CVE-2019-1947

2020-09-2301:15:14

CWE-20

cisco

web.nvd.nist.gov

cve-2019-1947

email filtering

cisco

asyncos

dos

remote attack

cpu utilization

CVSS2

7.8

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS3

8.6

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

AI Score

8.3

Confidence

High

EPSS

0.002

Percentile

52.7%

JSON

A vulnerability in the email message filtering feature of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to cause the CPU utilization to increase to 100 percent, causing a denial of service (DoS) condition on an affected device. The vulnerability is due to improper handling of email messages that contain large attachments. An attacker could exploit this vulnerability by sending a malicious email message through the targeted device. A successful exploit could allow the attacker to cause a permanent DoS condition due to high CPU utilization. This vulnerability may require manual intervention to recover the ESA.

Affected configurations

Nvd

Node

ciscoemail_security_applianceMatch11.1.0-131

ciscoasyncosMatch12.1.0-085

VendorProductVersionCPE
ciscoemail_security_appliance11.1.0-131cpe:2.3:a:cisco:email_security_appliance:11.1.0-131:*:*:*:*:*:*:*
ciscoasyncos12.1.0-085cpe:2.3:o:cisco:asyncos:12.1.0-085:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
cisco	email_security_appliance	11.1.0-131	cpe:2.3:a:cisco:email_security_appliance:11.1.0-131:::::::*
cisco	asyncos	12.1.0-085	cpe:2.3:o:cisco:asyncos:12.1.0-085:::::::*

CNA Affected

[
  {
    "product": "Cisco Email Security Appliance (ESA)",
    "vendor": "Cisco",
    "versions": [
      {
        "status": "affected",
        "version": "n/a"
      }
    ]
  }
]

References

tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200219-esa-dos

CVSS2

7.8

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS3

8.6

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

AI Score

8.3

Confidence

High

EPSS

0.002

Percentile

52.7%

JSON

Related for CVE-2019-1947