Skip to main content

Content Security Management Appliance CVE-2013-5537

HIGH
Improper Input Validation (CWE-20)
2013-10-24 psirt@cisco.com
7.8
CVSS 2.0 · NVD
Share

Severity by source

NVD PRIMARY
7.8 HIGH
AV:N/AC:L/Au:N/C:N/I:N/A:C

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Confidentiality
None
Integrity
None
Availability
C

Lifecycle Timeline

1
CVE Published
Oct 24, 2013 - 10:53 cve.org
HIGH 7.8

DescriptionCVE.org

The web framework on Cisco Web Security Appliance (WSA), Email Security Appliance (ESA), and Content Security Management Appliance (SMA) devices does not properly manage the state of HTTP and HTTPS sessions, which allows remote attackers to cause a denial of service (management GUI outage) via multiple TCP connections, aka Bug IDs CSCuj59411, CSCuf89818, and CSCuh05635.

AnalysisAI

The web framework on Cisco Web Security Appliance (WSA), Email Security Appliance (ESA), and Content Security Management Appliance (SMA) devices does not properly manage the state of HTTP and HTTPS. Rated high severity (CVSS 7.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-20. The web framework on Cisco Web Security Appliance (WSA), Email Security Appliance (ESA), and Content Security Management Appliance (SMA) devices does not properly manage the state of HTTP and HTTPS sessions, which allows remote attackers to cause a denial of service (management GUI outage) via multiple TCP connections, aka Bug IDs CSCuj59411, CSCuf89818, and CSCuh05635. Affected products include: Cisco Web Security Appliance, Cisco Content Security Management Appliance, Cisco Email Security Appliance Firmware.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

CVE-2016-2183 HIGH POC
7.5 Sep 01

The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other protocols and products, have a bi

CVE-2014-2119 HIGH
8.5 Mar 21

The End User Safelist/Blocklist (aka SLBL) service in Cisco AsyncOS Software for Email Security Appliance (ESA) before 7

CVE-2014-3289 MEDIUM POC
4.3 Jun 10

Cross-site scripting (XSS) vulnerability in the web management interface in Cisco AsyncOS on the Email Security Applianc

CVE-2015-0624 MEDIUM POC
4.3 Feb 21

The web framework in Cisco AsyncOS on Email Security Appliance (ESA), Content Security Management Appliance (SMA), and W

CVE-2015-6321 HIGH
7.8 Nov 06

Cisco AsyncOS before 8.5.7-042, 9.x before 9.1.0-032, 9.1.x before 9.1.1-023, and 9.5.x and 9.6.x before 9.6.0-042 on Em

CVE-2013-3395 MEDIUM
6.8 Jul 02

Cross-site request forgery (CSRF) vulnerability in the web framework on Cisco IronPort Web Security Appliance (WSA) devi

CVE-2021-1447 MEDIUM
6.7 May 06

A vulnerability in the user account management system of Cisco AsyncOS for Cisco Content Security Management Appliance (

CVE-2021-1516 MEDIUM
6.5 May 06

A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Content Security Management Ap

CVE-2020-3447 MEDIUM
6.5 Aug 17

A vulnerability in the CLI of Cisco AsyncOS for Cisco Email Security Appliance (ESA) and Cisco AsyncOS for Cisco Content

CVE-2018-0140 MEDIUM
6.5 Feb 08

A vulnerability in the spam quarantine of Cisco Email Security Appliance and Cisco Content Security Management Appliance

CVE-2017-6661 MEDIUM
6.1 Jun 13

A vulnerability in the web-based management interface of Cisco Email Security Appliance (ESA) and Cisco Content Security

CVE-2020-3178 MEDIUM
6.1 May 06

Multiple vulnerabilities in the web-based GUI of Cisco AsyncOS Software for Cisco Content Security Management Appliance

Share

CVE-2013-5537 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy