CVE-2020-3447— Cisco Content Security Management Appliance和Email Security Appliance 日志信息泄露漏洞

Cisco Email Security Appliance and Cisco Content Security Management Appliance Information Disclosure Vulnerability

A vulnerability in the CLI of Cisco AsyncOS for Cisco Email Security Appliance (ESA) and Cisco AsyncOS for Cisco Content Security Management Appliance (SMA) could allow an authenticated, remote attacker to access sensitive information on an affected device. The vulnerability is due to excessive verbosity in certain log subscriptions. An attacker could exploit this vulnerability by accessing specific log files on an affected device. A successful exploit could allow the attacker to obtain sensitive log data, which may include user credentials. To exploit this vulnerability, the attacker would need to have valid credentials at the operator level or higher on the affected device.

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L

通过日志文件的信息暴露

Cisco Content Security Management Appliance和Email Security Appliance 日志信息泄露漏洞

Cisco Content Security Management Appliance（SMA）和Cisco Email Security Appliance（ESA）都是美国思科（Cisco）公司的产品。Cisco Content Security Management Appliance是一套内容安全管理设备。该设备主要用于管理电子邮件和Web安全设备的所有策略、报告、审计信息等。Cisco Email Security Appliance是一个电子邮件安全设备。 Cisco ESA 13.5.1之前

N/A

N/A