CVE-2014-2195: Input Validation
First published: Tue May 20 2014(Updated: )
Cisco AsyncOS on Email Security Appliance (ESA) and Content Security Management Appliance (SMA) devices, when Active Directory is enabled, does not properly handle group names, which allows remote attackers to gain role privileges by leveraging group-name similarity, aka Bug ID CSCum86085.
Credit: ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco AsyncOS Software | ||
| Cisco Content Security Management | ||
| Cisco Email Security Appliance |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2014-2195?
CVE-2014-2195 is considered to have a medium severity level due to its potential to allow unauthorized role privilege escalation.
How do I fix CVE-2014-2195?
To mitigate CVE-2014-2195, ensure that you review and sanitize group names in Active Directory to prevent similar names from being exploited.
Who is affected by CVE-2014-2195?
CVE-2014-2195 affects Cisco AsyncOS on Email Security Appliances and Content Security Management Appliances with Active Directory enabled.
What kind of attack does CVE-2014-2195 facilitate?
CVE-2014-2195 facilitates remote attackers in gaining unauthorized role privileges through the exploitation of group-name similarity.
When was CVE-2014-2195 disclosed?
CVE-2014-2195 was disclosed in 2014 and is associated with vulnerabilities affecting Cisco's email and content security products.
- agent/references
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/last-modified-date
- agent/author
- agent/severity
- agent/description
- agent/event
- agent/first-publish-date
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/cisco
- canonical/cisco asyncos software
- canonical/cisco content security management
- canonical/cisco email security appliance