What is the CVSS score of CVE-2015-0624?

CVE-2015-0624 has a CVSS 2.0 base score of 4.3 (Medium). CVSS vector: AV:N/AC:M/Au:N/C:N/I:P/A:N. EPSS exploitation probability: 0.1%.

Is there a public PoC exploit available for CVE-2015-0624?

Yes, a public proof-of-concept exploit is available for CVE-2015-0624. Prioritise patching immediately. EPSS: 0.1%.

Content Security Management Appliance CVE-2015-0624

MEDIUM

Improper Input Validation (CWE-20)

2015-02-21 psirt@cisco.com

Cisco Information Disclosure Content Security Management Appliance Web Security Appliance Email Security Appliance Firmware

4.3

CVSS 2.0 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:M/Au:N/C:N/I:P/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

AV:N/AC:M/Au:N/C:N/I:P/A:N

Attack Vector

Network

Attack Complexity

Confidentiality

None

Integrity

Availability

None

Lifecycle Timeline

CVE Published

Feb 21, 2015 - 11:59 cve.org

MEDIUM 4.3

DescriptionCVE.org

The web framework in Cisco AsyncOS on Email Security Appliance (ESA), Content Security Management Appliance (SMA), and Web Security Appliance (WSA) devices allows remote attackers to trigger redirects via a crafted HTTP header, aka Bug IDs CSCur44412, CSCur44415, CSCur89630, CSCur89636, CSCur89633, and CSCur89639.

AnalysisAI

The web framework in Cisco AsyncOS on Email Security Appliance (ESA), Content Security Management Appliance (SMA), and Web Security Appliance (WSA) devices allows remote attackers to trigger. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-20. The web framework in Cisco AsyncOS on Email Security Appliance (ESA), Content Security Management Appliance (SMA), and Web Security Appliance (WSA) devices allows remote attackers to trigger redirects via a crafted HTTP header, aka Bug IDs CSCur44412, CSCur44415, CSCur89630, CSCur89636, CSCur89633, and CSCur89639. Affected products include: Cisco Content Security Management Appliance, Cisco Web Security Appliance, Cisco Email Security Appliance Firmware.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.