CVE-2018-0140

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

A vulnerability in the spam quarantine of Cisco Email Security Appliance and Cisco Content Security Management Appliance could allow an authenticated, remote attacker to download any message from the spam quarantine by modifying browser string information. The vulnerability is due to a lack of verification of authenticated user accounts. An attacker could exploit this vulnerability by modifying browser strings to see messages submitted by other users to the spam quarantine within their company. Cisco Bug IDs: CSCvg39759, CSCvg42295.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200 CWE-425

Affected software

Vendor	Product	Versions
n/a	Cisco Email Security Appliance and Cisco Content Security Management Appliance	Cisco Email Security Appliance and Cisco Content Security Management Appliance

References

http://www.securityfocus.com/bid/103090Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1040338Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1040339Third Party Advisory, VDB Entry
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180207-esacsmVendor Advisory
http://www.securityfocus.com/bid/103090Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1040338Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1040339Third Party Advisory, VDB Entry
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180207-esacsmVendor Advisory

Timeline

Published: Feb 8, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-01418.4A vulnerability in Cisco Prime Collaboration Provisioning (PCP) Software 11.6 could allow an unauthenticated, local attacker to log in to th CVE-2018-01446.1A vulnerability in the web-based management interface of Cisco Prime Data Center Network Manager could allow an unauthenticated, remote atta CVE-2018-01456.1A vulnerability in the web-based management interface of the Cisco Data Center Analytics Framework application could allow an unauthenticate CVE-2018-01465.4A vulnerability in the Cisco Data Center Analytics Framework application could allow an unauthenticated, remote attacker to conduct a cross-CVE-2018-01479.8A vulnerability in Java deserialization used by Cisco Secure Access Control System (ACS) prior to release 5.8 patch 9 could allow an unauthe CVE-2018-01488.8A vulnerability in the web-based management interface of Cisco UCS Director Software and Cisco Integrated Management Controller (IMC) Superv CVE-2018-01494.8A vulnerability in the web-based management interface of Cisco Integrated Management Controller Supervisor Software and Cisco UCS Director S CVE-2018-01509.8A vulnerability in Cisco IOS XE Software could allow an unauthenticated, remote attacker to log in to a device running an affected release o CVE-2018-01519.8A vulnerability in the quality of service (QoS) subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, re CVE-2018-01528.8A vulnerability in the web-based user interface (web UI) of Cisco IOS XE Software could allow an authenticated, remote attacker to gain elev CVE-2018-01547.5A vulnerability in the crypto engine of the Cisco Integrated Services Module for VPN (ISM-VPN) running Cisco IOS Software could allow an una CVE-2018-01558.6A vulnerability in the Bidirectional Forwarding Detection (BFD) offload implementation of Cisco Catalyst 4500 Series Switches and Cisco Cata