CVE-2021-1129— Cisco Email Security Appliance, Cisco Content Security Management Appliance, and Cisco Web Security Appliance Information Disclosure Vulnerability

Cisco Email Security Appliance, Cisco Content Security Management Appliance, and Cisco Web Security Appliance Information Disclosure Vulnerability

A vulnerability in the authentication for the general purpose APIs implementation of Cisco Email Security Appliance (ESA), Cisco Content Security Management Appliance (SMA), and Cisco Web Security Appliance (WSA) could allow an unauthenticated, remote attacker to access general system information and certain configuration information from an affected device. The vulnerability exists because a secure authentication token is not required when authenticating to the general purpose API. An attacker could exploit this vulnerability by sending a crafted request for information to the general purpose API on an affected device. A successful exploit could allow the attacker to obtain system and configuration information from the affected device, resulting in an unauthorized information disclosure.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

通过发送数据的信息暴露

多款Cisco产品授权问题漏洞

Cisco Content Security Management Appliance（SMA）等都是美国思科（Cisco）公司的产品。Cisco Content Security Management Appliance是一套内容安全管理设备。Cisco Email Security Appliance（ESA）是一个电子邮件安全设备。Cisco Web Security Appliance（WSA）是一款Web安全设备。 多款 Cisco 产品存在授权问题漏洞，该漏洞允许未经过身份验证的远程攻击者访问

N/A

N/A