Unscored severity · published Mar 21, 2014
CVE-2014-2119
The End User Safelist/Blocklist (aka SLBL) service in Cisco AsyncOS Software for Email Security Appliance (ESA) before 7.6.3-023 and 8.x before 8.0.1-023 and Cisco Content…
–
CVSS
2.7%
EPSS
No
On KEV
Description
The End User Safelist/Blocklist (aka SLBL) service in Cisco AsyncOS Software for Email Security Appliance (ESA) before 7.6.3-023 and 8.x before 8.0.1-023 and Cisco Content Security Management Appliance (SMA) before 7.9.1-110 and 8.x before 8.1.1-013 allows remote authenticated users to execute arbitrary code with root privileges via an FTP session that uploads a modified SLBL database file, aka Bug IDs CSCug79377 and CSCug80118.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.7% · higher than 86% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CS
Content Security Management Appliance · Cisco
All versions, or not specified · source: NVD
ES
Email Security Appliance Firmware · Cisco
All versions, or not specified · source: NVD
IA
Ironport Asyncos · Cisco
through 7.9.1-039; 8.0; 8.0.1; 8.1; through 7.6.2-201; 8.0; +1 more · source: NVD
Affected product
CS
Content Security Management Appliance
Cisco
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-2119
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-2119
Vendor Advisory
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140319-asyncos
More from Content Security Management Appliance
7.5
CVE-2016-2183
The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other protocols and products, have a birthday bound of approximately four billion blocks, which…
6.7
CVE-2021-1447
A vulnerability in the user account management system of Cisco AsyncOS for Cisco Content Security Management Appliance (SMA) could allow an authenticated, local attacker to…
6.5
CVE-2021-1516
A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Content Security Management Appliance (SMA), Cisco Email Security Appliance (ESA), and…
6.5
CVE-2020-3447
A vulnerability in the CLI of Cisco AsyncOS for Cisco Email Security Appliance (ESA) and Cisco AsyncOS for Cisco Content Security Management Appliance (SMA) could allow an…
6.5
CVE-2018-0140
A vulnerability in the spam quarantine of Cisco Email Security Appliance and Cisco Content Security Management Appliance could allow an authenticated, remote attacker to download…