Skip to content
CVE Tracker
Back

CVE-2018-0140

A vulnerability in the spam quarantine of Cisco Email Security Appliance and Cisco Content Security Management Appliance could allow an…

Medium6.5EPSS 1.6%
Published
Updated
Reserved
Assigned by
cisco

Description

A vulnerability in the spam quarantine of Cisco Email Security Appliance and Cisco Content Security Management Appliance could allow an authenticated, remote attacker to download any message from the spam quarantine by modifying browser string information. The vulnerability is due to a lack of verification of authenticated user accounts. An attacker could exploit this vulnerability by modifying browser strings to see messages submitted by other users to the spam quarantine within their company. Cisco Bug IDs: CSCvg39759, CSCvg42295.

Scores

CVSS scores of CVE-2018-0140, by who scored it
Scored byCVSSScoreVector
NVDNVD · Modified3.1Medium6.5CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS (exploitation in 30 days)
1.6% · top 25% of all CVEs (3 Nov 2026)
CISA SSVC
Exploitation: none · Automatable: no · Technical impact: partial
Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.5.

Weakness

Affected products

  • Cisco Email Security Appliance and Cisco Content Security Management Appliance

    • affected Cisco Email Security Appliance and Cisco Content Security Management Appliance

References (4)

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

CVE-2018-0140 badge
[![CVE-2018-0140](https://trackcve.app/badge/CVE-2018-0140.svg)](https://trackcve.app/cve/CVE-2018-0140)

Record last updated .