Read the docs
TI-2016-01311 Aliases CVE-2016-1423GHSA-9rr5-hm34-qcfm

Cross-site scripting in Cisco AsyncOS 8.0.2-069

Priority LOW 30CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

A vulnerability in the display of email messages in the Messages in Quarantine (MIQ) view in Cisco AsyncOS for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to cause a user to click a malicious link in the MIQ view. The malicious link could be used to facilitate a cross-site scripting (XSS) or HTML injection attack. More Information: CSCuz02235. Known Affected Releases: 8.0.2-069. Known Fixed Releases: 9.1.1-038 9.7.2-047.

Why it matters now

EPSS 0.01543 75th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—Cisco AsyncOS 8.0.2-069Cisco AsyncOS 8.0.2-069—No fix listedCNA
  • Cisco AsyncOS 8.0.2-069 Vendor— Affected Cisco AsyncOS 8.0.2-069 Fixed in — No fix listed CNA

CPE configurations NVD · 11

CPEVersionsRoleVendor
cpe:2.3:a:cisco:email_security_appliance:8.9.0:*:*:*:*:*:*:*8.9.0VulnerableCisco
cpe:2.3:a:cisco:email_security_appliance:8.9.1-000:*:*:*:*:*:*:*8.9.1-000VulnerableCisco
cpe:2.3:a:cisco:email_security_appliance:8.9.2-032:*:*:*:*:*:*:*8.9.2-032VulnerableCisco
cpe:2.3:a:cisco:email_security_appliance:9.0.0:*:*:*:*:*:*:*9.0.0VulnerableCisco
cpe:2.3:a:cisco:email_security_appliance:9.0.0-212:*:*:*:*:*:*:*9.0.0-212VulnerableCisco
cpe:2.3:a:cisco:email_security_appliance:9.0.0-461:*:*:*:*:*:*:*9.0.0-461VulnerableCisco
cpe:2.3:a:cisco:email_security_appliance:9.0.5-000:*:*:*:*:*:*:*9.0.5-000VulnerableCisco
cpe:2.3:a:cisco:email_security_appliance:9.1.0:*:*:*:*:*:*:*9.1.0VulnerableCisco
cpe:2.3:a:cisco:email_security_appliance:9.1.0-011:*:*:*:*:*:*:*9.1.0-011VulnerableCisco
cpe:2.3:a:cisco:email_security_appliance:9.1.0-032:*:*:*:*:*:*:*9.1.0-032VulnerableCisco
  • cpe:2.3:a:cisco:email_security_appliance:8.9.0:*:*:*:*:*:*:* Versions 8.9.0 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:email_security_appliance:8.9.1-000:*:*:*:*:*:*:* Versions 8.9.1-000 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:email_security_appliance:8.9.2-032:*:*:*:*:*:*:* Versions 8.9.2-032 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:email_security_appliance:9.0.0:*:*:*:*:*:*:* Versions 9.0.0 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:email_security_appliance:9.0.0-212:*:*:*:*:*:*:* Versions 9.0.0-212 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:email_security_appliance:9.0.0-461:*:*:*:*:*:*:* Versions 9.0.0-461 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:email_security_appliance:9.0.5-000:*:*:*:*:*:*:* Versions 9.0.5-000 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:email_security_appliance:9.1.0:*:*:*:*:*:*:* Versions 9.1.0 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:email_security_appliance:9.1.0-011:*:*:*:*:*:*:* Versions 9.1.0-011 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:email_security_appliance:9.1.0-032:*:*:*:*:*:*:* Versions 9.1.0-032 Vulnerable ·Cisco
Show 1 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:cisco:email_security_appliance:9.1.0-101:*:*:*:*:*:*:*9.1.0-101VulnerableCisco
  • cpe:2.3:a:cisco:email_security_appliance:9.1.0-101:*:*:*:*:*:*:* Versions 9.1.0-101 Vulnerable ·Cisco

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2016-1423
  2. 2026-10-03 Alias added: GHSA-9rr5-hm34-qcfm

References

Advisory 1

  • TI-2022-05357 Cisco Email Security Appliance and Cisco Secure Email and Web Manager External Authentication Bypass Vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2019-01567 Cisco Email Security Appliance Denial of Service Vulnerability CVSS 3.1HIGH 8.6
  • TI-2018-00378 Improper input validation in Cisco Email Security Appliance CVSS 3.0HIGH 7.5
  • TI-2020-02695 Cisco Email Security Appliance Content Filter Bypass Vulnerability CVSS 3.1HIGH 7.5
  • TI-2019-01541 Cisco Email Security Appliance Content Filter Bypass Vulnerability CVSS 3.0HIGH 7.5
  • TI-2019-01553 Cisco Email Security Appliance Content Filter Bypass Vulnerability CVSS 3.0HIGH 7.4
See all 49 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences