Cisco Security Mail Appliance Email Spam Quarantine Privilege Escalation Vulnerability

A vulnerability in the email Spam Quarantine, Lightweight Directory Access Protocol (LDAP) authentication of the Cisco Content Security Management Appliance (SMA) could allow an authenticated, remote attacker to escalate privileges to those of the Spam Quarantine.

The vulnerability is due to improper authentication privileges that are granted when a user performs LDAP authentication. An attacker could exploit this vulnerability by clicking on the URL that is sent in the spam notification email for a specific message in the Spam Quarantine. An exploit could allow the attacker read and write access to another user’s Spam Quarantine, which allows for manipulation of quarantine email messages and configurations.

Cisco has confirmed the vulnerability; however, software updates are not available.

To exploit this vulnerability, an attacker must authenticate to the targeted device. This access requirement reduces the likelihood of a successful exploit.

Cisco indicates through the CVSS score that functional exploit code exists; however, the code is not known to be publicly available.