CVE-2020-3132— Cisco Email Security Appliance Shortened URL Denial of Service Vulnerability
Quick assessment
Affected
Cisco Cisco Email Security Appliance (ESA)
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Cisco Email Security Appliance（ESA）是美国思科（Cisco）公司的一个电子邮件安全设备。 Cisco ESA和Cisco Cloud Email Security 12.5.1-037之前版本和13.0.0-375之前版本中的邮件消息扫描功能存在资源管理错误漏洞，该漏洞源于源于不正确的解析机制。攻击者可通过从受影响的设备发送大量恶意电子邮件来利用该漏洞造成拒绝服务。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2020-3132
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Cisco Email Security Appliance Shortened URL Denial of Service Vulnerability
Source: CVE Program / CVE List V5
Vulnerability Description
A vulnerability in the email message scanning feature of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to cause a temporary denial of service (DoS) condition on an affected device. The vulnerability is due to inadequate parsing mechanisms for specific email body components. An attacker could exploit this vulnerability by sending a malicious email containing a high number of shortened URLs through an affected device. A successful exploit could allow the attacker to consume processing resources, causing a DoS condition on an affected device. To successfully exploit this vulnerability, certain conditions beyond the control of the attacker must occur.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
未加控制的资源消耗(资源穷尽)
Source: CVE Program / CVE List V5
Vulnerability Title
Cisco Email Security Appliance和Cloud Email Security 资源管理错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Cisco Email Security Appliance（ESA）是美国思科（Cisco）公司的一个电子邮件安全设备。 Cisco ESA和Cisco Cloud Email Security 12.5.1-037之前版本和13.0.0-375之前版本中的邮件消息扫描功能存在资源管理错误漏洞，该漏洞源于源于不正确的解析机制。攻击者可通过从受影响的设备发送大量恶意电子邮件来利用该漏洞造成拒绝服务。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Cisco | Cisco Email Security Appliance (ESA) | unspecified ~ n/a | - |
|
II. Public POCs for CVE-2020-3132
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2020-3132
请登录查看更多情报信息。
Vendor Advisories for CVE-2020-3132 (1)
-
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-shrt-dos-wM54R8qA vendor-advisory x_refsource_CISCO
Same Patch Batch · Cisco · 2020-02-19 · 15 CVEs total
| CVE-2019-1950 | 8.4 HIGH | Cisco IOS XE SD-WAN Software Default Credentials Vulnerability |
| CVE-2020-3156 | 6.1 MEDIUM | Cisco Identity Services Engine Cross-Site Scripting Vulnerability |
| CVE-2015-0749 | 4.3 MEDIUM | Cisco Unified Communications Manager Cross-Site Scripting Vulnerability |
| CVE-2011-2054 | 4.3 MEDIUM | Cisco ASA Secondary Authentication Bypass Vulnerability |
| CVE-2020-3163 | Cisco Unified Contact Center Enterprise Denial of Service Vulnerability | |
| CVE-2020-3160 | Cisco Meeting Server Extensible Messaging and Presence Protocol Denial of Service Vulnerab | |
| CVE-2020-3159 | Cisco Finesse Web-Based Management Interface Cross-Site Scripting Vulnerability | |
| CVE-2020-3158 | Cisco Smart Software Manager On-Prem Static Default Credential Vulnerability | |
| CVE-2020-3154 | Cisco Cloud Web Security SQL Injection Vulnerability | |
| CVE-2020-3153 | Cisco AnyConnect Secure Mobility Client for Windows Uncontrolled Search Path Vulnerability | |
| CVE-2020-3138 | Cisco Enterprise NFV Infrastructure Software Remote Code Execution Vulnerability | |
| CVE-2020-3114 | Cisco Data Center Network Manager Cross-Site Request Forgery Vulnerability | |
| CVE-2020-3112 | Cisco Data Center Network Manager Privilege Escalation Vulnerability | |
| CVE-2020-3113 | Cisco Data Center Network Manager Stored Cross-Site Scripting Vulnerability |
IV. Related Vulnerabilities
Same product: Cisco Email Security Appliance (ESA)
-
CVE-2023-20057
Cisco Email Security Appliance 注入漏洞 -
CVE-2022-20798
Cisco Email Security Appliance and Cisco Secure Email and We -
CVE-2022-20664
Cisco Email Security Appliance and Cisco Secure Email and We -
CVE-2022-20653
Cisco Email Security Appliance DNS Verification Denial of Se -
CVE-2021-34741
Cisco Email Security Appliance Denial of Service Vulnerabili
Same vendor: Cisco
-
CVE-2026-76504
Cisco Catalyst SD-WAN Manager System Account Authorization B -
CVE-2026-76426
Cisco ISE REST API SQL Injection Vulnerability -
CVE-2026-20121
CIsco FTD Bypass Access List -
CVE-2026-76431
Cisco Identity Services Engine Arbitrary File Deletion Vulne -
CVE-2026-76427
Cisco ISE XML External Entity Injection Vulnerability
Same weakness: CWE-400
-
CVE-2026-86104
Fireware OS Resource Exhaustion in Login Process Allows Deni -
CVE-2026-18105
Fireware OS Uncontrolled Resource Consumption in Diagnostic -
CVE-2026-102821
Russh: Unbounded memory exhaustion via CHANNEL_OPEN flood du -
CVE-2026-102414
pbkdf2 rehashes long passwords on every iteration, enabling -
CVE-2026-102278
brace-expansion: DoS via uncontrolled recursion on nested br
V. Comments for CVE-2020-3132
No comments yet