Input validation error in Cisco AsyncOS for Cisco Email Security Appliance and Cisco Content Security Management Appliance - CVE-2019-1983
Published: February 20, 2020
Vulnerability identifier: #VU25484
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-1983
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists within the email message filtering feature due to insufficient input validation of email attachments. A remote attacker can send an email message with a crafted attachment through an affected
device and cause a denial of service condition on the target system.
Affected software
Cisco AsyncOS for Cisco Email Security Appliance
Cisco Content Security Management Appliance
Cisco Content Security Management Appliance
How to mitigate CVE-2019-1983
Install updates from vendor's website.
Cisco AsyncOS for Cisco Email Security Appliance - addressed in versions 11.0.3 251, 12.5.0 059
Cisco Content Security Management Appliance - addressed in versions 11.0.1 161, 12.5.0 633
Cisco Content Security Management Appliance - addressed in versions 11.0.1 161, 12.5.0 633