CVE-2021-1561: Cisco Secure Email and Web Manager Spam Quarantine Unauthorized Access Vulnerability
First published: Wed Aug 18 2021(Updated: )
A vulnerability in the spam quarantine feature of Cisco Secure Email and Web Manager, formerly Cisco Security Management Appliance (SMA), could allow an authenticated, remote attacker to gain unauthorized access and modify the spam quarantine settings of another user. This vulnerability exists because access to the spam quarantine feature is not properly restricted. An attacker could exploit this vulnerability by sending malicious requests to an affected system. A successful exploit could allow the attacker to modify another user's spam quarantine settings, possibly disabling security controls or viewing email messages stored on the spam quarantine interfaces.
Credit: ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco Secure Email and Web Manager | <=14.1 | |
| Cisco Secure Email and Web Manager |
Remedy
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sma-spam-jPxUXMk
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this Cisco Secure Email and Web Manager vulnerability?
The vulnerability ID for this Cisco Secure Email and Web Manager vulnerability is CVE-2021-1561.
What is the severity of CVE-2021-1561?
The severity of CVE-2021-1561 is medium with a CVSS score of 5.4.
How can an attacker exploit CVE-2021-1561?
An authenticated remote attacker can exploit CVE-2021-1561 by gaining unauthorized access and modifying the spam quarantine settings of another user.
Which software versions are affected by CVE-2021-1561?
Cisco Secure Email and Web Manager versions up to and including 14.1 are affected by CVE-2021-1561.
Is there a fix or patch available for CVE-2021-1561?
Yes, Cisco has released a security advisory with more information and mitigation details for CVE-2021-1561. Please refer to the reference link provided.
- collector/nvd-index
- agent/weakness
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/author
- agent/title
- agent/remedy
- agent/severity
- agent/references
- agent/last-modified-date
- agent/tags
- agent/description
- agent/first-publish-date
- agent/event
- vendor/cisco
- canonical/cisco secure email and web manager
- version/cisco secure email and web manager/14.1