Unscored severity · published Feb 21, 2015
CVE-2015-0624
The web framework in Cisco AsyncOS on Email Security Appliance (ESA), Content Security Management Appliance (SMA), and Web Security Appliance (WSA) devices allows remote attackers…
–
CVSS
2.2%
EPSS
No
On KEV
Description
The web framework in Cisco AsyncOS on Email Security Appliance (ESA), Content Security Management Appliance (SMA), and Web Security Appliance (WSA) devices allows remote attackers to trigger redirects via a crafted HTTP header, aka Bug IDs CSCur44412, CSCur44415, CSCur89630, CSCur89636, CSCur89633, and CSCur89639.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.2% · higher than 82% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CS
Content Security Management Appliance · Cisco
All versions, or not specified · source: NVD
ES
Email Security Appliance Firmware · Cisco
All versions, or not specified · source: NVD
WS
Web Security Appliance · Cisco
All versions, or not specified · source: NVD
Affected product
CS
Content Security Management Appliance
Cisco
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-0624
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-0624
Exploit
http://packetstormsecurity.com/files/130525/Cisco-Ironport-AsyncOS-HTTP-Header-Injection.html
Vendor Advisory
http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015-0624
www.securityfocus.com
http://www.securityfocus.com/bid/72702
www.securitytracker.com
http://www.securitytracker.com/id/1031781
www.securitytracker.com
http://www.securitytracker.com/id/1031782
More from Content Security Management Appliance
7.5
CVE-2016-2183
The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other protocols and products, have a birthday bound of approximately four billion blocks, which…
6.7
CVE-2021-1447
A vulnerability in the user account management system of Cisco AsyncOS for Cisco Content Security Management Appliance (SMA) could allow an authenticated, local attacker to…
6.5
CVE-2021-1516
A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Content Security Management Appliance (SMA), Cisco Email Security Appliance (ESA), and…
6.5
CVE-2020-3447
A vulnerability in the CLI of Cisco AsyncOS for Cisco Email Security Appliance (ESA) and Cisco AsyncOS for Cisco Content Security Management Appliance (SMA) could allow an…
6.5
CVE-2018-0140
A vulnerability in the spam quarantine of Cisco Email Security Appliance and Cisco Content Security Management Appliance could allow an authenticated, remote attacker to download…