Vulnerabilities > CVE-2018-0140 - Forced Browsing vulnerability in Cisco products

CVSS 6.5 - MEDIUM

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

LOW

Confidentiality impact

HIGH

Integrity impact

NONE

Availability impact

NONE

network

low complexity

cisco

CWE-425

NVD

Published: 2018-02-08

Updated: 2024-11-21

Summary

A vulnerability in the spam quarantine of Cisco Email Security Appliance and Cisco Content Security Management Appliance could allow an authenticated, remote attacker to download any message from the spam quarantine by modifying browser string information. The vulnerability is due to a lack of verification of authenticated user accounts. An attacker could exploit this vulnerability by modifying browser strings to see messages submitted by other users to the spam quarantine within their company. Cisco Bug IDs: CSCvg39759, CSCvg42295.

Vulnerable Configurations

Part	Description	Count
OS	Cisco Cisco Email Security Appliance Firmware 9.8.0-112 Cisco Email Security Appliance Firmware 10.0.1-087 Cisco Email Security Appliance Firmware 11.0.0-274 Cisco Content Security Management Appliance 10.0.0-096 Cisco Content Security Management Appliance 10.1.0-037 Cisco Content Security Management Appliance 10.1.0-052 Cisco Content Security Management Appliance 11.0.0-115	7
Hardware	Cisco Cisco Email Security Appliance C160 - Cisco Email Security Appliance C170 - Cisco Email Security Appliance C190 - Cisco Email Security Appliance C370 - Cisco Email Security Appliance C370D - Cisco Email Security Appliance C380 - Cisco Email Security Appliance C390 - Cisco Email Security Appliance C670 - Cisco Email Security Appliance C680 - Cisco Email Security Appliance C690 - Cisco Email Security Appliance C690X - Cisco Email Security Appliance X1070 - Cisco Content Security Management Appliance SMA M190 - Cisco Content Security Management Appliance SMA M390 - Cisco Content Security Management Appliance SMA M390X - Cisco Content Security Management Appliance SMA M690 - Cisco Content Security Management Appliance SMA M690X -	17

Common Weakness Enumeration (CWE)

CWE-425 - Direct Request ('Forced Browsing')

Common Attack Pattern Enumeration and Classification (CAPEC)

Directory Indexing
An adversary crafts a request to a target that results in the target listing/indexing the content of a directory as output. One common method of triggering directory contents as output is to construct a request containing a path that terminates in a directory name rather than a file name since many applications are configured to provide a list of the directory's contents when such a request is received. An adversary can use this to explore the directory tree on a target as well as learn the names of files. This can often end up revealing test files, backup files, temporary files, hidden files, configuration files, user accounts, script contents, as well as naming conventions, all of which can be used by an attacker to mount additional attacks.
Forceful Browsing
An attacker employs forceful browsing to access portions of a website that are otherwise unreachable through direct URL entry. Usually, a front controller or similar design pattern is employed to protect access to portions of a web application. Forceful browsing enables an attacker to access information, perform privileged operations and otherwise reach sections of the web application that have been improperly protected.

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

References