CVE-2023-20075
Description
Vulnerability in the CLI of Cisco Secure Email Gateway could allow an authenticated, remote attacker to execute arbitrary commands. These vulnerability is due to improper input validation in the CLI. An attacker could exploit this vulnerability by injecting operating system commands into a legitimate command. A successful exploit could allow the attacker to escape the restricted command prompt and execute arbitrary commands on the underlying operating system. To successfully exploit this vulnerability, an attacker would need valid Administrator credentials.
How to fix
- cisco email_security_appliance12.5.3-041, 13.0.5-007, 13.5.4-038, 14.2.1-020, 14.3.0-032 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| cisco email_security_appliance | 12.5.0 ≤ v < 12.5.3-041, 13.0.0 ≤ v < 13.0.5-007, 13.5.0 ≤ v < 13.5.4-038, 14.0.0 ≤ v < 14.2.1-020, 14.3.0 ≤ v < 14.3.0-032 | 12.5.3-041, 13.0.5-007, 13.5.4-038, 14.2.1-020, 14.3.0-032 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.