CVE-2014-2195: Input Validation
Cisco AsyncOS on Email Security Appliance (ESA) and Content Security Management Appliance (SMA) devices, when Active Directory is enabled, does not properly handle group names, which allows remote attackers to gain role privileges by leveraging group-name similarity, aka Bug ID CSCum86085.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-2195?
CVE-2014-2195 is considered to have a medium severity level due to its potential to allow unauthorized role privilege escalation.
How do I fix CVE-2014-2195?
To mitigate CVE-2014-2195, ensure that you review and sanitize group names in Active Directory to prevent similar names from being exploited.
Who is affected by CVE-2014-2195?
CVE-2014-2195 affects Cisco AsyncOS on Email Security Appliances and Content Security Management Appliances with Active Directory enabled.
What kind of attack does CVE-2014-2195 facilitate?
CVE-2014-2195 facilitates remote attackers in gaining unauthorized role privileges through the exploitation of group-name similarity.
When was CVE-2014-2195 disclosed?
CVE-2014-2195 was disclosed in 2014 and is associated with vulnerabilities affecting Cisco's email and content security products.