CVE-2023-20075: OS Command Injection
First published: Thu Feb 16 2023(Updated: )
Vulnerability in the CLI of Cisco Secure Email Gateway could allow an authenticated, remote attacker to execute arbitrary commands. These vulnerability is due to improper input validation in the CLI. An attacker could exploit this vulnerability by injecting operating system commands into a legitimate command. A successful exploit could allow the attacker to escape the restricted command prompt and execute arbitrary commands on the underlying operating system. To successfully exploit this vulnerability, an attacker would need valid Administrator credentials.
Credit: ykramarz@cisco.com ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco Email Security Appliance | >=12.5.0<12.5.3-041 | |
| Cisco Email Security Appliance | >=13.0.0<13.0.5-007 | |
| Cisco Email Security Appliance | >=13.5.0<13.5.4-038 | |
| Cisco Email Security Appliance | >=14.0.0<14.2.1-020 | |
| Cisco Email Security Appliance | >=14.3.0<14.3.0-032 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2023-20075.
What is the severity of CVE-2023-20075?
The severity of CVE-2023-20075 is medium with a CVSS score of 6.7.
What is the affected software?
The affected software is Cisco Email Security Appliance versions 12.5.0 to 12.5.3-041, 13.0.0 to 13.0.5-007, 13.5.0 to 13.5.4-038, 14.0.0 to 14.2.1-020, and 14.3.0-032.
What is the vulnerability description?
The vulnerability in the CLI of Cisco Secure Email Gateway allows an authenticated remote attacker to execute arbitrary commands by injecting operating system commands into a legitimate input.
How can the vulnerability be exploited?
The vulnerability can be exploited by an authenticated remote attacker injecting operating system commands into a legitimate input.
- collector/nvd-index
- agent/softwarecombine
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/weakness
- agent/author
- agent/last-modified-date
- agent/references
- agent/tags
- agent/first-publish-date
- agent/event
- agent/description
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- vendor/cisco
- canonical/cisco email security appliance
- version/cisco email security appliance/12.5.0
- version/cisco email security appliance/13.0.0
- version/cisco email security appliance/13.5.0
- version/cisco email security appliance/14.0.0
- version/cisco email security appliance/14.3.0