CVE-2019-1933: Cisco Email Security Appliance Content Filter Bypass Vulnerability
First published: Sat Jul 06 2019(Updated: )
A vulnerability in the email message scanning of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to bypass configured filters on the device. The vulnerability is due to improper input validation of certain email fields. An attacker could exploit this vulnerability by sending a crafted email message to a recipient protected by the ESA. A successful exploit could allow the attacker to bypass configured message filters and inject arbitrary scripting code inside the email body. The malicious code is not executed by default unless the recipient's email client is configured to execute scripts contained in emails.
Credit: ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco Email Security Appliance | =11.1.2-023 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID of this vulnerability?
The vulnerability ID is CVE-2019-1933.
What is the title of this vulnerability?
The title of this vulnerability is 'A vulnerability in the email message scanning of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to bypass configured filters on the device.'
What is the severity of CVE-2019-1933?
The severity of CVE-2019-1933 is high.
How does CVE-2019-1933 affect Cisco Email Security Appliance?
CVE-2019-1933 affects Cisco Email Security Appliance version 11.1.2-023.
Is there a fix available for CVE-2019-1933?
Yes, Cisco has released a fix for CVE-2019-1933. Please refer to the provided reference for more information.
- collector/nvd-index
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/references
- agent/weakness
- agent/title
- agent/last-modified-date
- agent/author
- agent/first-publish-date
- agent/tags
- agent/description
- agent/event
- vendor/cisco
- canonical/cisco email security appliance
- version/cisco email security appliance/11.1.2-023