Lucene search

[email protected]CVE-2023-20075

HistoryMar 01, 2023 - 8:15 a.m.

CVE-2023-20075

2023-03-0108:15:12

CWE-78

CWE-77

[email protected]

web.nvd.nist.gov

cve-2023-20075

cisco

secure email gateway

vulnerability

cli

remote code execution

nvd

6.7 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

6.9 Medium

AI Score

Confidence

High

0.0005 Low

EPSS

Percentile

17.6%

JSON

Vulnerability in the CLI of Cisco Secure Email Gateway could allow an authenticated, remote attacker to execute arbitrary commands.

These vulnerability is due to improper input validation in the CLI. An attacker could exploit this vulnerability by injecting operating system commands into a legitimate command. A successful exploit could allow the attacker to escape the restricted command prompt and execute arbitrary commands on the underlying operating system. To successfully exploit this vulnerability, an attacker would need valid Administrator credentials.

Affected configurations

NVD

Node

ciscoemail_security_applianceRange12.5.0–12.5.3-041

ciscoemail_security_applianceRange13.0.0–13.0.5-007

ciscoemail_security_applianceRange13.5.0–13.5.4-038

ciscoemail_security_applianceRange14.0.0–14.2.1-020

ciscoemail_security_applianceRange14.3.0–14.3.0-032

CPENameOperatorVersion
cisco:email_security_appliancecisco email security appliancelt12.5.3-041
cisco:email_security_appliancecisco email security appliancelt13.0.5-007
cisco:email_security_appliancecisco email security appliancelt13.5.4-038
cisco:email_security_appliancecisco email security appliancelt14.2.1-020
cisco:email_security_appliancecisco email security appliancelt14.3.0-032

CPE	Name	Operator	Version
cisco:email_security_appliance	cisco email security appliance	lt	12.5.3-041
cisco:email_security_appliance	cisco email security appliance	lt	13.0.5-007
cisco:email_security_appliance	cisco email security appliance	lt	13.5.4-038
cisco:email_security_appliance	cisco email security appliance	lt	14.2.1-020
cisco:email_security_appliance	cisco email security appliance	lt	14.3.0-032

CNA Affected

[
  {
    "vendor": "Cisco",
    "product": "Cisco Secure Email",
    "versions": [
      {
        "version": "13.0.0-392",
        "status": "affected"
      },
      {
        "version": "13.5.1-277",
        "status": "affected"
      },
      {
        "version": "12.5.0-066",
        "status": "affected"
      },
      {
        "version": "14.0.0-698",
        "status": "affected"
      },
      {
        "version": "14.2.0-620",
        "status": "affected"
      }
    ]
  }
]