« Volver al listado

CVE-2014-2119

Estado: ModificadaAlta (8.5)—

The End User Safelist/Blocklist (aka SLBL) service in Cisco AsyncOS Software for Email Security Appliance (ESA) before 7.6.3-023 and 8.x before 8.0.1-023 and Cisco Content Security Management Appliance (SMA) before 7.9.1-110 and 8.x before 8.1.1-013 allows remote authenticated users to execute arbitrary code with root privileges via an FTP session that uploads a modified SLBL database file, aka Bug IDs CSCug79377 and CSCug80118.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (3)

Cisco — Content Security Management ApplianceCisco — Email Security Appliance FirmwareCisco — Ironport Asyncos

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2014-2119",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 8.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:S/C:C/I:C/A:C",
          "authentication": "SINGLE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 6.8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@cisco.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2014-03-21T01:04:02.937",
  "references": [
    {
      "url": "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140319-asyncos",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "psirt@cisco.com"
    },
    {
      "url": "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140319-asyncos",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-264"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The End User Safelist/Blocklist (aka SLBL) service in Cisco AsyncOS Software for Email Security Appliance (ESA) before 7.6.3-023 and 8.x before 8.0.1-023 and Cisco Content Security Management Appliance (SMA) before 7.9.1-110 and 8.x before 8.1.1-013 allows remote authenticated users to execute arbitrary code with root privileges via an FTP session that uploads a modified SLBL database file, aka Bug IDs CSCug79377 and CSCug80118."
    },
    {
      "lang": "es",
      "value": "El servicio End User Safelist/Blocklist (también conocido como SLBL) en el software Cisco AsyncOS para Email Security Appliance (ESA) anterior a 7.6.3-023 y 8.x anterior a 8.0.1-023 y Cisco Content Security Management Appliance (SMA) anterior a 7.9.1-110 y 8.x anterior a 8.1.1-013 permite a usuarios remotos autenticados ejecutar código arbitrario con privilegios root a través de una sesión FTP que sube un archivo de base de datos SLBL modificado, también conocido como Bug IDs CSCug79377 y CSCug80118."
    }
  ],
  "lastModified": "2026-06-17T00:06:05.727",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:ironport_asyncos:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "29D12C74-EB0D-4FE2-936E-06D7080C584A",
              "versionEndIncluding": "7.9.1-039"
            },
            {
              "criteria": "cpe:2.3:o:cisco:ironport_asyncos:8.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DEBB85CD-0DE0-49CF-80F2-4E343F3E151E"
            },
            {
              "criteria": "cpe:2.3:o:cisco:ironport_asyncos:8.0.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5165DB3A-40BC-4179-A7DE-92CD2E6784D6"
            },
            {
              "criteria": "cpe:2.3:o:cisco:ironport_asyncos:8.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8CD06A8A-9708-4E53-BEC8-C43938BB336C"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:content_security_management_appliance:-:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "60635EC8-9AFA-400D-A919-66E60CDEF852"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:ironport_asyncos:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B88B09B9-3F50-4A40-9F54-D36E8E511F8B",
              "versionEndIncluding": "7.6.2-201"
            },
            {
              "criteria": "cpe:2.3:o:cisco:ironport_asyncos:8.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DEBB85CD-0DE0-49CF-80F2-4E343F3E151E"
            },
            {
              "criteria": "cpe:2.3:o:cisco:ironport_asyncos:8.0.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5165DB3A-40BC-4179-A7DE-92CD2E6784D6"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cisco:email_security_appliance_firmware:-:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5BA3A518-E103-4D98-A040-88ED4E0D73CC"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "psirt@cisco.com"
}