CVE-2014-2119

2014-03-2101:04:02

CWE-264

[email protected]

web.nvd.nist.gov

CVSS2

8.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:S/C:C/I:C/A:C

AI Score

7.3

Confidence

Low

EPSS

0.002

Percentile

57.1%

JSON

The End User Safelist/Blocklist (aka SLBL) service in Cisco AsyncOS Software for Email Security Appliance (ESA) before 7.6.3-023 and 8.x before 8.0.1-023 and Cisco Content Security Management Appliance (SMA) before 7.9.1-110 and 8.x before 8.1.1-013 allows remote authenticated users to execute arbitrary code with root privileges via an FTP session that uploads a modified SLBL database file, aka Bug IDs CSCug79377 and CSCug80118.

Affected configurations

Nvd

Node

ciscoironport_asyncosRange≤7.9.1-039

ciscoironport_asyncosMatch8.0

ciscoironport_asyncosMatch8.0.1

ciscoironport_asyncosMatch8.1

AND

ciscocontent_security_management_applianceMatch-

Node

ciscoironport_asyncosRange≤7.6.2-201

ciscoironport_asyncosMatch8.0

ciscoironport_asyncosMatch8.0.1

AND

ciscoemail_security_appliance_firmwareMatch-

VendorProductVersionCPE
ciscoironport_asyncos*cpe:2.3:o:cisco:ironport_asyncos:*:*:*:*:*:*:*:*
ciscoironport_asyncos8.0cpe:2.3:o:cisco:ironport_asyncos:8.0:*:*:*:*:*:*:*
ciscoironport_asyncos8.0.1cpe:2.3:o:cisco:ironport_asyncos:8.0.1:*:*:*:*:*:*:*
ciscoironport_asyncos8.1cpe:2.3:o:cisco:ironport_asyncos:8.1:*:*:*:*:*:*:*
ciscocontent_security_management_appliance-cpe:2.3:h:cisco:content_security_management_appliance:-:*:*:*:*:*:*:*
ciscoemail_security_appliance_firmware-cpe:2.3:o:cisco:email_security_appliance_firmware:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
cisco	ironport_asyncos	*	cpe:2.3:o:cisco:ironport_asyncos::::::::
cisco	ironport_asyncos	8.0	cpe:2.3:o:cisco:ironport_asyncos:8.0:::::::*
cisco	ironport_asyncos	8.0.1	cpe:2.3:o:cisco:ironport_asyncos:8.0.1:::::::*
cisco	ironport_asyncos	8.1	cpe:2.3:o:cisco:ironport_asyncos:8.1:::::::*
cisco	content_security_management_appliance	-	cpe:2.3:h:cisco:content_security_management_appliance:-:::::::*
cisco	email_security_appliance_firmware	-	cpe:2.3:o:cisco:email_security_appliance_firmware:-:::::::*