{
  "document": {
    "aggregate_severity": {
      "text": "mittel"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Die Cisco Email Security Appliance ist eine E-Mail-Sicherheitsl\u00f6sung.\r\nCisco AsyncOS ist ein Betriebssystem f\u00fcr Cisco Appliances.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Cisco Email Security Appliance und Cisco AsyncOS ausnutzen, um seine Privilegien zu erh\u00f6hen und beliebige Befehle auszuf\u00fchren.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- CISCO Appliance",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2023-0399 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2023/wid-sec-w-2023-0399.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2023-0399 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2023-0399"
      },
      {
        "category": "external",
        "summary": "Cisco Security Advisory cisco-sa-esa-sma-privesc-9DVkFpJ8 vom 2023-02-15",
        "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-sma-privesc-9DVkFpJ8"
      }
    ],
    "source_lang": "en-US",
    "title": "Cisco AsyncOS: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2023-02-15T23:00:00.000+00:00",
      "generator": {
        "date": "2024-08-15T17:43:51.844+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.3.5"
        }
      },
      "id": "WID-SEC-W-2023-0399",
      "initial_release_date": "2023-02-15T23:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2023-02-15T23:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Cisco AsyncOS \u003c 12.5.4-041",
                "product": {
                  "name": "Cisco AsyncOS \u003c 12.5.4-041",
                  "product_id": "T026385",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:cisco:asyncos:12.5.4-041"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Cisco AsyncOS \u003c 13.0.5-007",
                "product": {
                  "name": "Cisco AsyncOS \u003c 13.0.5-007",
                  "product_id": "T026386",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:cisco:asyncos:13.0.5-007"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Cisco AsyncOS \u003c 13.5.4-038",
                "product": {
                  "name": "Cisco AsyncOS \u003c 13.5.4-038",
                  "product_id": "T026387",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:cisco:asyncos:13.5.4-038"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Cisco AsyncOS \u003c 14.2.1-020",
                "product": {
                  "name": "Cisco AsyncOS \u003c 14.2.1-020",
                  "product_id": "T026388",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:cisco:asyncos:14.2.1-020"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Cisco AsyncOS \u003c 14.3.0-032",
                "product": {
                  "name": "Cisco AsyncOS \u003c 14.3.0-032",
                  "product_id": "T026389",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:cisco:asyncos:14.3.0-032"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Cisco AsyncOS \u003c 12.8.1-021",
                "product": {
                  "name": "Cisco AsyncOS \u003c 12.8.1-021",
                  "product_id": "T026390",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:cisco:asyncos:12.8.1-021"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Cisco AsyncOS \u003c 14.2.0-224",
                "product": {
                  "name": "Cisco AsyncOS \u003c 14.2.0-224",
                  "product_id": "T026391",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:cisco:asyncos:14.2.0-224"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Cisco AsyncOS \u003c 14.3.0-120",
                "product": {
                  "name": "Cisco AsyncOS \u003c 14.3.0-120",
                  "product_id": "T026392",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:cisco:asyncos:14.3.0-120"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Cisco AsyncOS \u003c 13.8.1-108",
                "product": {
                  "name": "Cisco AsyncOS \u003c 13.8.1-108",
                  "product_id": "T026393",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:cisco:asyncos:13.8.1-108"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "AsyncOS"
          },
          {
            "category": "product_name",
            "name": "Cisco Email Security Appliance",
            "product": {
              "name": "Cisco Email Security Appliance",
              "product_id": "T014037",
              "product_identification_helper": {
                "cpe": "cpe:/h:cisco:email_security_appliance:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Cisco"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-20075",
      "notes": [
        {
          "category": "description",
          "text": "Es besteht eine Schwachstelle in Cisco Email Security Appliance und Cisco AsyncOS aufgrund einer unsachgem\u00e4\u00dfen Eingabevalidierung in der Befehlszeilenschnittstelle (CLI). Ein authentifizierter Angreifer mit mindestens \"Operator-Level\" Privilegien kann dies ausnutzen, um beliebige Betriebssystembefehle einzuschleusen, die mit den Rechten des CLI-Prozessbenutzers ausgef\u00fchrt werden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T014037"
        ]
      },
      "release_date": "2023-02-15T23:00:00.000+00:00",
      "title": "CVE-2023-20075"
    },
    {
      "cve": "CVE-2023-20009",
      "notes": [
        {
          "category": "description",
          "text": "Es existiert eine Schwachstelle in Cisco Email Security Appliance und Cisco AsyncOS. Wird eine SNMP Konfigurationsdatei \u00fcber die \"web UI\" hochgeladen, wird diese nicht ordnungsgem\u00e4\u00df gepr\u00fcft. Ein authentisierter Angreifer mit mindestens \"Operator-Level\" Berechtigungen kann dies ausnutzen, um beliebige Kommandos als \"root\" auf dem Betriebssystem auszuf\u00fchren."
        }
      ],
      "product_status": {
        "known_affected": [
          "T014037"
        ]
      },
      "release_date": "2023-02-15T23:00:00.000+00:00",
      "title": "CVE-2023-20009"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Cisco Email Security Appliance versions 14.0.x ant\u00e9rieures \u00e0 14.2.1-020",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    },
    {
      "description": "Cisco Secure Endpoint (ex Advanced Malware Protection for Endpoints) pour Windows versions ant\u00e9rieures \u00e0 7.5.9 et 8.1.5",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    },
    {
      "description": "Cisco Email Security Appliance versions ant\u00e9rieures \u00e0 12.5.4-041",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    },
    {
      "description": "Cisco Secure Email and Web Manager versions ant\u00e9rieures \u00e0 12.8.1-021",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    },
    {
      "description": "Cisco Secure Web Appliance, formerly Web Security Appliance versions ant\u00e9rieures \u00e0 14.0.4-005 et 15.0.0-254",
      "product": {
        "name": "Secure Web Appliance",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    },
    {
      "description": "Cisco Secure Email and Web Manager versions 13.8.x ant\u00e9rieures \u00e0 13.8.1-108",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    },
    {
      "description": "Cisco Secure Email and Web Manager versions 14.3.x ant\u00e9rieures \u00e0 14.3.0-120",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    },
    {
      "description": "Cisco Nexus Dashboard version ant\u00e9rieures \u00e0 2.3(1c)",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    },
    {
      "description": "Cisco Secure Endpoint Private Cloud versions ant\u00e9rieures \u00e0 3.6.0 avec les connecteurs \u00e0 jour",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    },
    {
      "description": "Cisco Secure Email and Web Manager versions 14.2.x ant\u00e9rieures \u00e0 14.2.1-020",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    },
    {
      "description": "Cisco Email Security Appliance versions 14.3.x ant\u00e9rieures \u00e0 14.3.0-032",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    },
    {
      "description": "Cisco Secure Endpoint (ex Advanced Malware Protection for Endpoints) pour MacOS versions ant\u00e9rieures \u00e0 1.21.1",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    },
    {
      "description": "Cisco Email Security Appliance versions 13.0.x ant\u00e9rieures \u00e0 13.0.5-007",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    },
    {
      "description": "Cisco Secure Email and Web Manager versions 14.0.x ant\u00e9rieures \u00e0 14.2.0-224",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    },
    {
      "description": "Cisco Secure Endpoint (ex Advanced Malware Protection for Endpoints) pour Linux versions ant\u00e9rieures \u00e0 1.20.2",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    },
    {
      "description": "Cisco Email Security Appliance versions 13.5.x ant\u00e9rieures \u00e0 13.5.4-038",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2023-20009",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-20009"
    },
    {
      "name": "CVE-2023-20075",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-20075"
    },
    {
      "name": "CVE-2023-20014",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-20014"
    },
    {
      "name": "CVE-2023-20032",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-20032"
    }
  ],
  "links": [
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Cisco Security Advisory du 15 f\u00e9vrier 2023",
      "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-sma-privesc-9DVkFpJ8"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Cisco Security Advisory du 15 f\u00e9vrier 2023",
      "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-clamav-q8DThCy"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Cisco Security Advisory du 15 f\u00e9vrier 2023",
      "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ndb-dnsdos-bYscZOsu"
    }
  ],
  "reference": "CERTFR-2023-AVI-0138",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2023-02-16T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans \u003cspan\nclass=\"textit\"\u003eCisco Security Advisory\u003c/span\u003e. Elles permettent \u00e0 un\nattaquant de provoquer un d\u00e9ni de service \u00e0 distance, une ex\u00e9cution de\ncode arbitraire \u00e0 distance et une \u00e9l\u00e9vation de privil\u00e8ges.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Cisco",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-ndb-dnsdos-bYscZOsu du 15 f\u00e9vrier 2023",
      "url": null
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-clamav-q8DThCy du 15 f\u00e9vrier 2023",
      "url": null
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-esa-sma-privesc-9DVkFpJ8 du 15 f\u00e9vrier 2023",
      "url": null
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Cisco Email Security Appliance versions 14.0.x ant\u00e9rieures \u00e0 14.2.1-020",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    },
    {
      "description": "Cisco Secure Endpoint (ex Advanced Malware Protection for Endpoints) pour Windows versions ant\u00e9rieures \u00e0 7.5.9 et 8.1.5",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    },
    {
      "description": "Cisco Email Security Appliance versions ant\u00e9rieures \u00e0 12.5.4-041",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    },
    {
      "description": "Cisco Secure Email and Web Manager versions ant\u00e9rieures \u00e0 12.8.1-021",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    },
    {
      "description": "Cisco Secure Web Appliance, formerly Web Security Appliance versions ant\u00e9rieures \u00e0 14.0.4-005 et 15.0.0-254",
      "product": {
        "name": "Secure Web Appliance",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    },
    {
      "description": "Cisco Secure Email and Web Manager versions 13.8.x ant\u00e9rieures \u00e0 13.8.1-108",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    },
    {
      "description": "Cisco Secure Email and Web Manager versions 14.3.x ant\u00e9rieures \u00e0 14.3.0-120",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    },
    {
      "description": "Cisco Nexus Dashboard version ant\u00e9rieures \u00e0 2.3(1c)",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    },
    {
      "description": "Cisco Secure Endpoint Private Cloud versions ant\u00e9rieures \u00e0 3.6.0 avec les connecteurs \u00e0 jour",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    },
    {
      "description": "Cisco Secure Email and Web Manager versions 14.2.x ant\u00e9rieures \u00e0 14.2.1-020",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    },
    {
      "description": "Cisco Email Security Appliance versions 14.3.x ant\u00e9rieures \u00e0 14.3.0-032",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    },
    {
      "description": "Cisco Secure Endpoint (ex Advanced Malware Protection for Endpoints) pour MacOS versions ant\u00e9rieures \u00e0 1.21.1",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    },
    {
      "description": "Cisco Email Security Appliance versions 13.0.x ant\u00e9rieures \u00e0 13.0.5-007",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    },
    {
      "description": "Cisco Secure Email and Web Manager versions 14.0.x ant\u00e9rieures \u00e0 14.2.0-224",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    },
    {
      "description": "Cisco Secure Endpoint (ex Advanced Malware Protection for Endpoints) pour Linux versions ant\u00e9rieures \u00e0 1.20.2",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    },
    {
      "description": "Cisco Email Security Appliance versions 13.5.x ant\u00e9rieures \u00e0 13.5.4-038",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2023-20009",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-20009"
    },
    {
      "name": "CVE-2023-20075",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-20075"
    },
    {
      "name": "CVE-2023-20014",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-20014"
    },
    {
      "name": "CVE-2023-20032",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-20032"
    }
  ],
  "links": [
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Cisco Security Advisory du 15 f\u00e9vrier 2023",
      "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-sma-privesc-9DVkFpJ8"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Cisco Security Advisory du 15 f\u00e9vrier 2023",
      "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-clamav-q8DThCy"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Cisco Security Advisory du 15 f\u00e9vrier 2023",
      "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ndb-dnsdos-bYscZOsu"
    }
  ],
  "reference": "CERTFR-2023-AVI-0138",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2023-02-16T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans \u003cspan\nclass=\"textit\"\u003eCisco Security Advisory\u003c/span\u003e. Elles permettent \u00e0 un\nattaquant de provoquer un d\u00e9ni de service \u00e0 distance, une ex\u00e9cution de\ncode arbitraire \u00e0 distance et une \u00e9l\u00e9vation de privil\u00e8ges.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Cisco",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-ndb-dnsdos-bYscZOsu du 15 f\u00e9vrier 2023",
      "url": null
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-clamav-q8DThCy du 15 f\u00e9vrier 2023",
      "url": null
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-esa-sma-privesc-9DVkFpJ8 du 15 f\u00e9vrier 2023",
      "url": null
    }
  ]
}

{
  "GSD": {
    "alias": "CVE-2023-20009",
    "id": "GSD-2023-20009"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2023-20009"
      ],
      "details": "A vulnerability in the Web UI and administrative CLI of the Cisco Secure Email Gateway (ESA) and Cisco Secure Email and Web Manager (SMA) could allow an authenticated remote attacker and or authenticated local attacker to escalate their privilege level and gain root access. The attacker has to have a valid user credential with at least a [[privilege of operator - validate actual name]]. The vulnerability is due to the processing of a specially crafted SNMP configuration file. An attacker could exploit this vulnerability by authenticating to the targeted device and uploading a specially crafted SNMP configuration file that when uploaded could allow for the execution of commands as root. An exploit could allow the attacker to gain root access on the device.",
      "id": "GSD-2023-20009",
      "modified": "2023-12-13T01:20:29.393255Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "psirt@cisco.com",
        "ID": "CVE-2023-20009",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "Cisco Secure Email",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "=",
                          "version_value": "11.0.3-238"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "11.1.0-069"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "11.1.0-131"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "11.1.0-128"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "12.0.0-419"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "12.1.0-071"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "12.1.0-087"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "12.1.0-089"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "13.0.0-392"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "13.5.1-277"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "12.5.0-066"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "14.0.0-698"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "14.2.0-620"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "Cisco Secure Email and Web Manager",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "=",
                          "version_value": "11.0.0-115"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "11.0.1-161"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "11.5.1-105"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "12.0.0-452"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "12.0.1-011"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "12.5.0-636"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "12.5.0-658"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "12.5.0-678"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "12.5.0-670"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "13.0.0-277"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "13.6.2-078"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "13.8.1-068"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "13.8.1-074"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "12.8.1-002"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "14.0.0-404"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "14.1.0-223"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "14.1.0-227"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "14.2.0-212"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "Cisco"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "A vulnerability in the Web UI and administrative CLI of the Cisco Secure Email Gateway (ESA) and Cisco Secure Email and Web Manager (SMA) could allow an authenticated remote attacker and or authenticated local attacker to escalate their privilege level and gain root access. The attacker has to have a valid user credential with at least a [[privilege of operator - validate actual name]].\r\n\r The vulnerability is due to the processing of a specially crafted SNMP configuration file. An attacker could exploit this vulnerability by authenticating to the targeted device and uploading a specially crafted SNMP configuration file that when uploaded could allow for the execution of commands as root. An exploit could allow the attacker to gain root access on the device."
          }
        ]
      },
      "exploit": [
        {
          "lang": "en",
          "value": "The Cisco PSIRT is aware that proof-of-concept exploit code is available for the vulnerabilities that are described in this advisory.\r\n\r\nThe Cisco PSIRT is not aware of any malicious use of the vulnerabilities that are described in this advisory."
        }
      ],
      "impact": {
        "cvss": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "cweId": "CWE-20",
                "lang": "eng",
                "value": "Improper Input Validation"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-sma-privesc-9DVkFpJ8",
            "refsource": "MISC",
            "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-sma-privesc-9DVkFpJ8"
          }
        ]
      },
      "source": {
        "advisory": "cisco-sa-esa-sma-privesc-9DVkFpJ8",
        "defects": [
          "CSCwd29901",
          "CSCwd29905"
        ],
        "discovery": "EXTERNAL"
      }
    },
    "nvd.nist.gov": {
      "cve": {
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:cisco:email_security_appliance:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "DFF0842A-E854-4188-A561-56FEA052A553",
                    "versionEndExcluding": "12.5.3-041",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:cisco:email_security_appliance:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "53BC2A26-68D8-44F5-8C36-22ECBD492F96",
                    "versionEndExcluding": "13.0.5-007",
                    "versionStartIncluding": "13.0.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:cisco:email_security_appliance:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "E2720C1E-1AD6-4EB0-8BBC-7E23F069539B",
                    "versionEndExcluding": "13.5.4-038",
                    "versionStartIncluding": "13.5.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:cisco:email_security_appliance:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "5EA000FA-4AEA-4A05-883E-52333F4445FA",
                    "versionEndExcluding": "14.2.1-020",
                    "versionStartIncluding": "14.0.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:cisco:email_security_appliance:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "05D45B94-07E6-436D-8936-317463E77608",
                    "versionEndExcluding": "14.3.0-032",
                    "versionStartIncluding": "14.3.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:cisco:secure_email_and_web_manager:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "9A15F884-ACBF-4CC8-BE9B-0369B600F378",
                    "versionEndExcluding": "12.8.1-021",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:cisco:secure_email_and_web_manager:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "26652060-E3C9-401B-A520-E1A768F76334",
                    "versionEndExcluding": "13.8.1-108",
                    "versionStartIncluding": "13.8.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:cisco:secure_email_and_web_manager:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "6A32B4D8-F1A3-4233-AD64-CCC016E037C0",
                    "versionEndExcluding": "14.2.0-224",
                    "versionStartIncluding": "14.0.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:cisco:secure_email_and_web_manager:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "28540076-CF1E-4584-BD17-929F4346FAA2",
                    "versionEndExcluding": "14.3.0-120",
                    "versionStartIncluding": "14.3.0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "descriptions": [
          {
            "lang": "en",
            "value": "A vulnerability in the Web UI and administrative CLI of the Cisco Secure Email Gateway (ESA) and Cisco Secure Email and Web Manager (SMA) could allow an authenticated remote attacker and or authenticated local attacker to escalate their privilege level and gain root access. The attacker has to have a valid user credential with at least a [[privilege of operator - validate actual name]].\r\n\r The vulnerability is due to the processing of a specially crafted SNMP configuration file. An attacker could exploit this vulnerability by authenticating to the targeted device and uploading a specially crafted SNMP configuration file that when uploaded could allow for the execution of commands as root. An exploit could allow the attacker to gain root access on the device."
          }
        ],
        "id": "CVE-2023-20009",
        "lastModified": "2024-01-25T17:15:24.400",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.2,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "HIGH",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.2,
              "impactScore": 5.9,
              "source": "nvd@nist.gov",
              "type": "Primary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 6.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "HIGH",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 1.2,
              "impactScore": 5.2,
              "source": "ykramarz@cisco.com",
              "type": "Secondary"
            }
          ]
        },
        "published": "2023-03-01T08:15:11.767",
        "references": [
          {
            "source": "ykramarz@cisco.com",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-sma-privesc-9DVkFpJ8"
          }
        ],
        "sourceIdentifier": "ykramarz@cisco.com",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-434"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          },
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-20"
              }
            ],
            "source": "ykramarz@cisco.com",
            "type": "Secondary"
          }
        ]
      }
    }
  }
}

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:cisco:email_security_appliance:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "DFF0842A-E854-4188-A561-56FEA052A553",
              "versionEndExcluding": "12.5.3-041",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cisco:email_security_appliance:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "53BC2A26-68D8-44F5-8C36-22ECBD492F96",
              "versionEndExcluding": "13.0.5-007",
              "versionStartIncluding": "13.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cisco:email_security_appliance:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "E2720C1E-1AD6-4EB0-8BBC-7E23F069539B",
              "versionEndExcluding": "13.5.4-038",
              "versionStartIncluding": "13.5.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cisco:email_security_appliance:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "5EA000FA-4AEA-4A05-883E-52333F4445FA",
              "versionEndExcluding": "14.2.1-020",
              "versionStartIncluding": "14.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cisco:email_security_appliance:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "05D45B94-07E6-436D-8936-317463E77608",
              "versionEndExcluding": "14.3.0-032",
              "versionStartIncluding": "14.3.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cisco:secure_email_and_web_manager:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "9A15F884-ACBF-4CC8-BE9B-0369B600F378",
              "versionEndExcluding": "12.8.1-021",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cisco:secure_email_and_web_manager:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "26652060-E3C9-401B-A520-E1A768F76334",
              "versionEndExcluding": "13.8.1-108",
              "versionStartIncluding": "13.8.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cisco:secure_email_and_web_manager:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "6A32B4D8-F1A3-4233-AD64-CCC016E037C0",
              "versionEndExcluding": "14.2.0-224",
              "versionStartIncluding": "14.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cisco:secure_email_and_web_manager:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "28540076-CF1E-4584-BD17-929F4346FAA2",
              "versionEndExcluding": "14.3.0-120",
              "versionStartIncluding": "14.3.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability in the Web UI and administrative CLI of the Cisco Secure Email Gateway (ESA) and Cisco Secure Email and Web Manager (SMA) could allow an authenticated remote attacker and or authenticated local attacker to escalate their privilege level and gain root access. The attacker has to have a valid user credential with at least a [[privilege of operator - validate actual name]].\r\n\r The vulnerability is due to the processing of a specially crafted SNMP configuration file. An attacker could exploit this vulnerability by authenticating to the targeted device and uploading a specially crafted SNMP configuration file that when uploaded could allow for the execution of commands as root. An exploit could allow the attacker to gain root access on the device."
    }
  ],
  "id": "CVE-2023-20009",
  "lastModified": "2024-11-21T07:40:20.017",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 1.2,
        "impactScore": 5.2,
        "source": "psirt@cisco.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.2,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.2,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2023-03-01T08:15:11.767",
  "references": [
    {
      "source": "psirt@cisco.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-sma-privesc-9DVkFpJ8"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-sma-privesc-9DVkFpJ8"
    }
  ],
  "sourceIdentifier": "psirt@cisco.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ],
      "source": "psirt@cisco.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-434"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

{
  "document": {
    "acknowledgments": [
      {
        "summary": "Cisco would like to thank ly1g3 for reporting the vulnerabilities described in CVE-2023-20009 and CVE-2023-20075.\r\n\r\nCisco would also like to thank \u00c1lvaro Gutierrez of mnemonic for reporting the vulnerability described in CVE-2023-20075."
      }
    ],
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "notes": [
      {
        "category": "summary",
        "text": "Multiple vulnerabilities in the web UI and CLI of Cisco Email Security Appliance (ESA) and Cisco Secure Email and Web Manager could allow an authenticated attacker to perform injection attacks or elevate privileges.\r\n\r\nFor more information about these vulnerabilities, see the Details [\"#details\"] section of this advisory.\r\n\r\nCisco has released software updates that address these vulnerabilities. There are no workarounds that address these vulnerabilities.\r\n\r\n",
        "title": "Summary"
      },
      {
        "category": "general",
        "text": "CVE-2023-20009 affects Cisco ESA and Cisco Secure Email and Web Manager, both virtual and physical appliances, if they are running a vulnerable release of Cisco AsyncOS Software.\r\n\r\nCVE-2023-20075 affects Cisco ESA, both virtual and physical appliances, if they are running a vulnerable release of Cisco AsyncOS Software.\r\n\r\nFor information about which Cisco software releases are vulnerable, see the Fixed Software [\"#fs\"] section of this advisory.",
        "title": "Vulnerable Products"
      },
      {
        "category": "general",
        "text": "Only products listed in the Vulnerable Products [\"#vp\"] section of this advisory are known to be affected by these vulnerabilities.\r\n\r\nCisco has confirmed that CVE-2023-20009 does not affect Cisco Secure Web Appliance, formerly Cisco Web Security Appliance (WSA).\r\n\r\nCisco has confirmed that CVE-2023-20075 does not affect Cisco Secure Email and Web Manager or Cisco Secure Web Appliance.\r\n\r\nAttention: Simplifying the Cisco portfolio includes the renaming of security products under one brand: Cisco Secure. For more information, see Meet Cisco Secure [\"https://www.cisco.com/c/en/us/products/security/secure-names.html\"].",
        "title": "Products Confirmed Not Vulnerable"
      },
      {
        "category": "general",
        "text": "The vulnerabilities are not dependent on one another. Exploitation of one of the vulnerabilities is not required to exploit the other vulnerability. In addition, a software release that is affected by one of the vulnerabilities may not be affected by the other vulnerability.\r\n\r\nDetails about the vulnerabilities are as follows:\r\n\r\nCVE-2023-20009: Cisco ESA and Cisco Secure Email and Web Manager Privilege Escalation Vulnerability\r\n\r\nA vulnerability in the web UI and CLI of Cisco ESA and Cisco Secure Email and Web Manager could allow an authenticated, remote attacker (web UI) or authenticated, local attacker (CLI) to elevate privileges to root. The attacker must have valid user credentials with Operator-level privileges or higher.\r\n\r\nThis vulnerability is due to the improper validation of an uploaded Simple Network Management Protocol (SNMP) configuration file. An attacker could exploit this vulnerability by authenticating to the affected device and uploading a specially crafted SNMP configuration file. A successful exploit could allow the attacker to execute commands as root.\r\n\r\nCisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.\r\n\r\nBug ID(s): CSCwd29901 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwd29901\"], CSCwd29905 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwd29905\"]\r\nCVE ID: CVE-2023-20009\r\nSecurity Impact Rating (SIR): High\r\nCVSS Base Score: 6.5\r\nCVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N\r\n\r\nCVE-2023-20075: Cisco ESA Command Injection Vulnerability\r\n\r\nA vulnerability in the CLI of Cisco ESA could allow an authenticated, local attacker to execute arbitrary commands on an affected device.\r\n\r\nThis vulnerability is due to improper input validation in the CLI. An attacker could exploit this vulnerability by injecting operating system commands into a legitimate command. A successful exploit could allow the attacker to escape the restricted command prompt and execute arbitrary commands on the underlying operating system as the CLI process user. To successfully exploit this vulnerability, an attacker must have valid user credentials with Operator-level privileges or higher.\r\n\r\nCisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.\r\n\r\nBug ID(s): CSCwd50043 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwd50043\"]\r\nCVE ID: CVE-2023-20075\r\nSecurity Impact Rating (SIR): High\r\nCVSS Base Score: 6.0\r\nCVSS Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N",
        "title": "Details"
      },
      {
        "category": "general",
        "text": "There are no workarounds that address these vulnerabilities.",
        "title": "Workarounds"
      },
      {
        "category": "general",
        "text": "Cisco has released free software updates [\"https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html#ssu\"] that address the vulnerabilities described in this advisory. Customers with service contracts that entitle them to regular software updates should obtain security fixes through their usual update channels.\r\n\r\nCustomers may only install and expect support for software versions and feature sets for which they have purchased a license. By installing, downloading, accessing, or otherwise using such software upgrades, customers agree to follow the terms of the Cisco software license:\r\nhttps://www.cisco.com/c/en/us/products/end-user-license-agreement.html [\"https://www.cisco.com/c/en/us/products/end-user-license-agreement.html\"]\r\n\r\nAdditionally, customers may only download software for which they have a valid license, procured from Cisco directly, or through a Cisco authorized reseller or partner. In most cases this will be a maintenance upgrade to software that was previously purchased. Free security software updates do not entitle customers to a new software license, additional software feature sets, or major revision upgrades.\r\n\r\nThe Cisco Support and Downloads page [\"https://www.cisco.com/c/en/us/support/index.html\"] on Cisco.com provides information about licensing and downloads. This page can also display customer device support coverage for customers who use the My Devices tool.\r\n\r\nWhen considering software upgrades [\"https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html#fixes\"], customers are advised to regularly consult the advisories for Cisco products, which are available from the Cisco Security Advisories page [\"https://www.cisco.com/go/psirt\"], to determine exposure and a complete upgrade solution.\r\n\r\nIn all cases, customers should ensure that the devices to be upgraded contain sufficient memory and confirm that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, customers are advised to contact the Cisco Technical Assistance Center (TAC) or their contracted maintenance providers.\r\n  Customers Without Service Contracts\r\nCustomers who purchase directly from Cisco but do not hold a Cisco service contract and customers who make purchases through third-party vendors but are unsuccessful in obtaining fixed software through their point of sale should obtain upgrades by contacting the Cisco TAC: https://www.cisco.com/c/en/us/support/web/tsd-cisco-worldwide-contacts.html [\"https://www.cisco.com/c/en/us/support/web/tsd-cisco-worldwide-contacts.html\"]\r\n\r\nCustomers should have the product serial number available and be prepared to provide the URL of this advisory as evidence of entitlement to a free upgrade.\r\n      Fixed Releases\r\nCustomers are advised to upgrade to an appropriate fixed software release [\"https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html#fixes\"] as indicated in the following tables:\r\n\r\nESA\r\n        Cisco AsyncOS Software Release  First Fixed Release for CVE-2023-20009  First Fixed Release for CVE-2023-20075          Earlier than 12.5  Migrate to a fixed release.  Not vulnerable.      12.5\r\n12.5.3-041\r\n\r\n12.5.3-041\r\n        13.0  13.0.5-007  13.0.5-007      13.5  13.5.4-038  13.5.4-038      14.0  14.2.1-020  14.2.1-020      14.3  14.3.0-0321  14.3.0-0321\r\n1. This release is for cloud-based products.\r\nSecure Email and Web Manager\r\n        Cisco AsyncOS Software Release  First Fixed Release for CVE-2023-20009          Earlier than 12.8  Migrate to a fixed release.      12.8  12.8.1-021      13.8  13.8.1-108      14.0  14.2.0-224      14.31  14.3.0-1201\r\n1. This release is for cloud-based products.\r\nIn most cases, the software can be upgraded over the network by using the System Upgrade options in the web interface of the appliance. To upgrade a device by using the web interface, do the following:\r\n\r\nChoose System Administration \u003e System Upgrade.\r\nClick Upgrade Options.\r\nChoose Download and Install.\r\nChoose the release to upgrade to.\r\nIn the Upgrade Preparation area, choose the appropriate options.\r\nClick Proceed to begin the upgrade. A progress bar displays the status of the upgrade.\r\n\r\nAfter the upgrade is complete, the device reboots.\r\n\r\nCisco Cloud Email Security (CES) includes Cisco Email Security Appliance (ESA) and Cisco Secure Email and Web Manager devices as part of the service solution. Cisco provides regular maintenance of the products included in this solution. Customers can also request a software upgrade by contacting Cisco CES support.\r\n\r\nThe Cisco Product Security Incident Response Team (PSIRT) validates only the affected and fixed release information that is documented in this advisory.",
        "title": "Fixed Software"
      },
      {
        "category": "general",
        "text": "To learn about Cisco security vulnerability disclosure policies and publications, see the Security Vulnerability Policy [\"http://www.cisco.com/web/about/security/psirt/security_vulnerability_policy.html\"]. This document also contains instructions for obtaining fixed software and receiving security vulnerability information from Cisco.",
        "title": "Vulnerability Policy"
      },
      {
        "category": "general",
        "text": "The Cisco PSIRT is aware that proof-of-concept exploit code is available for the vulnerabilities that are described in this advisory.\r\n\r\nThe Cisco PSIRT is not aware of any malicious use of the vulnerabilities that are described in this advisory.",
        "title": "Exploitation and Public Announcements"
      },
      {
        "category": "general",
        "text": "Cisco would like to thank ly1g3 for reporting the vulnerabilities described in CVE-2023-20009 and CVE-2023-20075.\r\n\r\nCisco would also like to thank \u00c1lvaro Gutierrez of mnemonic for reporting the vulnerability described in CVE-2023-20075.",
        "title": "Source"
      },
      {
        "category": "legal_disclaimer",
        "text": "THIS DOCUMENT IS PROVIDED ON AN \"AS IS\" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME.\r\n\r\nA standalone copy or paraphrase of the text of this document that omits the distribution URL is an uncontrolled copy and may lack important information or contain factual errors. The information in this document is intended for end users of Cisco products.",
        "title": "Legal Disclaimer"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "psirt@cisco.com",
      "issuing_authority": "Cisco PSIRT",
      "name": "Cisco",
      "namespace": "https://wwww.cisco.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "Cisco Email Security Appliance and Cisco Secure Email and Web Manager Vulnerabilities",
        "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-sma-privesc-9DVkFpJ8"
      },
      {
        "category": "external",
        "summary": "Cisco Security Vulnerability Policy",
        "url": "https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html"
      },
      {
        "category": "external",
        "summary": "Meet Cisco Secure",
        "url": "https://www.cisco.com/c/en/us/products/security/secure-names.html"
      },
      {
        "category": "external",
        "summary": "CSCwd29901",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwd29901"
      },
      {
        "category": "external",
        "summary": "CSCwd29905",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwd29905"
      },
      {
        "category": "external",
        "summary": "CSCwd50043",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwd50043"
      },
      {
        "category": "external",
        "summary": "free software updates",
        "url": "https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html#ssu"
      },
      {
        "category": "external",
        "summary": "https://www.cisco.com/c/en/us/products/end-user-license-agreement.html",
        "url": "https://www.cisco.com/c/en/us/products/end-user-license-agreement.html"
      },
      {
        "category": "external",
        "summary": "Cisco Support and Downloads page",
        "url": "https://www.cisco.com/c/en/us/support/index.html"
      },
      {
        "category": "external",
        "summary": "considering software upgrades",
        "url": "https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html#fixes"
      },
      {
        "category": "external",
        "summary": "Cisco Security Advisories page",
        "url": "https://www.cisco.com/go/psirt"
      },
      {
        "category": "external",
        "summary": "https://www.cisco.com/c/en/us/support/web/tsd-cisco-worldwide-contacts.html",
        "url": "https://www.cisco.com/c/en/us/support/web/tsd-cisco-worldwide-contacts.html"
      },
      {
        "category": "external",
        "summary": "Security Vulnerability Policy",
        "url": "http://www.cisco.com/web/about/security/psirt/security_vulnerability_policy.html"
      }
    ],
    "title": "Cisco Email Security Appliance and Cisco Secure Email and Web Manager Vulnerabilities",
    "tracking": {
      "current_release_date": "2023-02-16T17:32:38+00:00",
      "generator": {
        "date": "2024-05-10T23:21:57+00:00",
        "engine": {
          "name": "TVCE"
        }
      },
      "id": "cisco-sa-esa-sma-privesc-9DVkFpJ8",
      "initial_release_date": "2023-02-15T16:00:00+00:00",
      "revision_history": [
        {
          "date": "2023-02-15T15:53:38+00:00",
          "number": "1.0.0",
          "summary": "Initial public release."
        },
        {
          "date": "2023-02-16T17:32:38+00:00",
          "number": "1.1.0",
          "summary": "Updated fixed release information."
        }
      ],
      "status": "final",
      "version": "1.1.0"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_family",
            "name": "Cisco Secure Email",
            "product": {
              "name": "Cisco Secure Email ",
              "product_id": "CSAFPID-189790"
            }
          },
          {
            "category": "product_family",
            "name": "Cisco Secure Email and Web Manager",
            "product": {
              "name": "Cisco Secure Email and Web Manager ",
              "product_id": "CSAFPID-189791"
            }
          }
        ],
        "category": "vendor",
        "name": "Cisco"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-20009",
      "ids": [
        {
          "system_name": "Cisco Bug ID",
          "text": "CSCwd29901"
        },
        {
          "system_name": "Cisco Bug ID",
          "text": "CSCwd29905"
        }
      ],
      "notes": [
        {
          "category": "other",
          "text": "Complete.",
          "title": "Affected Product Comprehensiveness"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-189790",
          "CSAFPID-189791"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Cisco has released software updates that address this vulnerability.",
          "product_ids": [
            "CSAFPID-189791",
            "CSAFPID-189790"
          ],
          "url": "https://software.cisco.com"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-189790",
            "CSAFPID-189791"
          ]
        }
      ],
      "title": "Cisco Email Security Appliance and Cisco Content Security Management Appliance Privlidge Escalation Vulnerability"
    },
    {
      "cve": "CVE-2023-20075",
      "ids": [
        {
          "system_name": "Cisco Bug ID",
          "text": "CSCwd50043"
        }
      ],
      "notes": [
        {
          "category": "other",
          "text": "Complete.",
          "title": "Affected Product Comprehensiveness"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-189790"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Cisco has released software updates that address this vulnerability.",
          "product_ids": [
            "CSAFPID-189790"
          ],
          "url": "https://software.cisco.com"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.0,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-189790"
          ]
        }
      ],
      "title": "Cisco Secure Email Gateway Command Injection Vulnerability"
    }
  ]
}

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-202302-1598",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "secure email and web manager",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "13.8.0"
      },
      {
        "model": "secure email and web manager",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "14.0.0"
      },
      {
        "model": "secure email and web manager",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "14.3.0"
      },
      {
        "model": "secure email and web manager",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "14.2.0-224"
      },
      {
        "model": "email security appliance",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "13.5.0"
      },
      {
        "model": "email security appliance",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "12.5.3-041"
      },
      {
        "model": "secure email and web manager",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "13.8.1-108"
      },
      {
        "model": "secure email and web manager",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "14.3.0-120"
      },
      {
        "model": "email security appliance",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "14.0.0"
      },
      {
        "model": "email security appliance",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "13.0.5-007"
      },
      {
        "model": "email security appliance",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "14.3.0"
      },
      {
        "model": "email security appliance",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "13.0.0"
      },
      {
        "model": "email security appliance",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "14.3.0-032"
      },
      {
        "model": "email security appliance",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "14.2.1-020"
      },
      {
        "model": "secure email and web manager",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "12.8.1-021"
      },
      {
        "model": "email security appliance",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "13.5.4-038"
      },
      {
        "model": "cisco secure email and web manager",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "\u30b7\u30b9\u30b3\u30b7\u30b9\u30c6\u30e0\u30ba",
        "version": "13.8.0  that\u0027s all  13.8.1-108"
      },
      {
        "model": "cisco email security appliance",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u30b7\u30b9\u30b3\u30b7\u30b9\u30c6\u30e0\u30ba",
        "version": null
      },
      {
        "model": "cisco secure email and web manager",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "\u30b7\u30b9\u30b3\u30b7\u30b9\u30c6\u30e0\u30ba",
        "version": "12.8.1-021"
      },
      {
        "model": "cisco secure email and web manager",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "\u30b7\u30b9\u30b3\u30b7\u30b9\u30c6\u30e0\u30ba",
        "version": "14.3.0  that\u0027s all  14.3.0-120"
      },
      {
        "model": "cisco secure email and web manager",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "\u30b7\u30b9\u30b3\u30b7\u30b9\u30c6\u30e0\u30ba",
        "version": "14.0.0  that\u0027s all  14.2.0-224"
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2023-003790"
      },
      {
        "db": "NVD",
        "id": "CVE-2023-20009"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:cisco:secure_email_and_web_manager:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "14.3.0-120",
                "versionStartIncluding": "14.3.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:cisco:secure_email_and_web_manager:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "14.2.0-224",
                "versionStartIncluding": "14.0.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:cisco:secure_email_and_web_manager:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "13.8.1-108",
                "versionStartIncluding": "13.8.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:cisco:secure_email_and_web_manager:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "12.8.1-021",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:cisco:email_security_appliance:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "14.3.0-032",
                "versionStartIncluding": "14.3.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:cisco:email_security_appliance:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "14.2.1-020",
                "versionStartIncluding": "14.0.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:cisco:email_security_appliance:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "13.5.4-038",
                "versionStartIncluding": "13.5.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:cisco:email_security_appliance:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "13.0.5-007",
                "versionStartIncluding": "13.0.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:cisco:email_security_appliance:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "12.5.3-041",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2023-20009"
      }
    ]
  },
  "cve": "CVE-2023-20009",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [],
        "cvssV3": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "author": "NVD",
            "availabilityImpact": "HIGH",
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "exploitabilityScore": 1.2,
            "impactScore": 5.9,
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "trust": 1.0,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "author": "ykramarz@cisco.com",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "exploitabilityScore": 1.2,
            "impactScore": 5.2,
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "trust": 1.0,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          {
            "attackComplexity": "Low",
            "attackVector": "Network",
            "author": "NVD",
            "availabilityImpact": "High",
            "baseScore": 7.2,
            "baseSeverity": "High",
            "confidentialityImpact": "High",
            "exploitabilityScore": null,
            "id": "CVE-2023-20009",
            "impactScore": null,
            "integrityImpact": "High",
            "privilegesRequired": "High",
            "scope": "Unchanged",
            "trust": 0.8,
            "userInteraction": "None",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "NVD",
            "id": "CVE-2023-20009",
            "trust": 1.8,
            "value": "HIGH"
          },
          {
            "author": "ykramarz@cisco.com",
            "id": "CVE-2023-20009",
            "trust": 1.0,
            "value": "MEDIUM"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-202303-044",
            "trust": 0.6,
            "value": "HIGH"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2023-003790"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202303-044"
      },
      {
        "db": "NVD",
        "id": "CVE-2023-20009"
      },
      {
        "db": "NVD",
        "id": "CVE-2023-20009"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "A vulnerability in the Web UI and administrative CLI of the Cisco Secure Email Gateway (ESA) and Cisco Secure Email and Web Manager (SMA) could allow an authenticated remote attacker and or authenticated local attacker to escalate their privilege level and gain root access. The attacker has to have a valid user credential with at least a [[privilege of operator - validate actual name]]. \r\n\r The vulnerability is due to the processing of a specially crafted SNMP configuration file. An attacker could exploit this vulnerability by authenticating to the targeted device and uploading a specially crafted SNMP configuration file that when uploaded could allow for the execution of commands as root. An exploit could allow the attacker to gain root access on the device. Cisco Systems Cisco Email Security Appliance and secure email and web manager Contains a vulnerability related to unlimited uploads of dangerous types of files.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. \nFor more information about these vulnerabilities, see the Details section of this advisory. \nCisco has released software updates that address these vulnerabilities. There are no workarounds that address these vulnerabilities. \nThis advisory is available at the following link:sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-sma-privesc-9DVkFpJ8",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2023-20009"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2023-003790"
      },
      {
        "db": "VULMON",
        "id": "CVE-2023-20009"
      }
    ],
    "trust": 1.71
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2023-20009",
        "trust": 3.3
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2023-003790",
        "trust": 0.8
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202303-044",
        "trust": 0.6
      },
      {
        "db": "VULMON",
        "id": "CVE-2023-20009",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2023-20009"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2023-003790"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202303-044"
      },
      {
        "db": "NVD",
        "id": "CVE-2023-20009"
      }
    ]
  },
  "id": "VAR-202302-1598",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VARIoT devices database",
        "id": null
      }
    ],
    "trust": 0.43892258
  },
  "last_update_date": "2024-01-29T19:16:42.815000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "cisco-sa-esa-sma-privesc-9DVkFpJ8",
        "trust": 0.8,
        "url": "https://sec.cloudapps.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-esa-sma-privesc-9dvkfpj8"
      },
      {
        "title": "Cisco Secure Email Fixes for code issue vulnerabilities",
        "trust": 0.6,
        "url": "http://123.124.177.30/web/xxk/bdxqbyid.tag?id=228469"
      },
      {
        "title": "Cisco: Cisco Email Security Appliance and Cisco Secure Email and Web Manager Vulnerabilities",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=cisco_security_advisories_and_alerts_ciscoproducts\u0026qid=cisco-sa-esa-sma-privesc-9dvkfpj8"
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2023-20009"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2023-003790"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202303-044"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-434",
        "trust": 1.0
      },
      {
        "problemtype": "Unlimited uploads of dangerous types of files (CWE-434) [NVD evaluation ]",
        "trust": 0.8
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2023-003790"
      },
      {
        "db": "NVD",
        "id": "CVE-2023-20009"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 1.7,
        "url": "https://sec.cloudapps.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-esa-sma-privesc-9dvkfpj8"
      },
      {
        "trust": 0.8,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2023-20009"
      },
      {
        "trust": 0.6,
        "url": "https://cxsecurity.com/cveshow/cve-2023-20009/"
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2023-20009"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2023-003790"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202303-044"
      },
      {
        "db": "NVD",
        "id": "CVE-2023-20009"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "VULMON",
        "id": "CVE-2023-20009"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2023-003790"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202303-044"
      },
      {
        "db": "NVD",
        "id": "CVE-2023-20009"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2023-10-13T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2023-003790"
      },
      {
        "date": "2023-03-01T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-202303-044"
      },
      {
        "date": "2023-03-01T08:15:11.767000",
        "db": "NVD",
        "id": "CVE-2023-20009"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2023-10-13T01:03:00",
        "db": "JVNDB",
        "id": "JVNDB-2023-003790"
      },
      {
        "date": "2023-03-13T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-202303-044"
      },
      {
        "date": "2024-01-25T17:15:24.400000",
        "db": "NVD",
        "id": "CVE-2023-20009"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-202303-044"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Cisco Systems \u00a0Cisco\u00a0Email\u00a0Security\u00a0Appliance\u00a0 and \u00a0secure\u00a0email\u00a0and\u00a0web\u00a0manager\u00a0 Vulnerability in unlimited upload of dangerous types of files in",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2023-003790"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "code problem",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-202303-044"
      }
    ],
    "trust": 0.6
  }
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-20009"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-20",
      "CWE-434"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-03-01T08:15:00Z",
    "severity": "HIGH"
  },
  "details": "A vulnerability in the Web UI and administrative CLI of the Cisco Secure Email Gateway (ESA) and Cisco Secure Email and Web Manager (SMA) could allow an authenticated remote attacker and or authenticated local attacker to escalate their privilege level and gain root access. The attacker has to have a valid user credential with at least a [[privilege of operator - validate actual name]]. The vulnerability is due to the processing of a specially crafted SNMP configuration file. An attacker could exploit this vulnerability by authenticating to the targeted device and uploading a specially crafted SNMP configuration file that when uploaded could allow for the execution of commands as root. An exploit could allow the attacker to gain root access on the device.",
  "id": "GHSA-rj99-fcj2-r7fw",
  "modified": "2023-03-10T18:30:22Z",
  "published": "2023-03-01T09:30:29Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-20009"
    },
    {
      "type": "WEB",
      "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-sma-privesc-9DVkFpJ8"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}