Information disclosure in Cisco Email Security Appliance and Cisco Content Security…
Priority LOW 32CWE-200Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure, Security bypass
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-200 and CWE-425.
Summary
A vulnerability in the spam quarantine of Cisco Email Security Appliance and Cisco Content Security Management Appliance could allow an authenticated, remote attacker to download any message from the spam quarantine by modifying browser string information. The vulnerability is due to a lack of verification of authenticated user accounts. An attacker could exploit this vulnerability by modifying browser strings to see messages submitted by other users to the spam quarantine within their company. Cisco Bug IDs: CSCvg39759, CSCvg42295.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01563 75th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | Cisco Email Security Appliance and Cisco Content Security Management Appliance | Cisco Email Security Appliance and Cisco Content Security Management Appliance | — | No fix listed | CNA |
- Cisco Email Security Appliance and Cisco Content Security Management Appliance Vendor— Affected Cisco Email Security Appliance and Cisco Content Security Management Appliance Fixed in — No fix listed CNA
CPE configurations NVD · 24
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:cisco:email_security_appliance_firmware:9.8.0-112:*:*:*:*:*:*:* | 9.8.0-112 | Vulnerable | Cisco |
| cpe:2.3:o:cisco:email_security_appliance_firmware:10.0.1-087:*:*:*:*:*:*:* | 10.0.1-087 | Vulnerable | Cisco |
| cpe:2.3:o:cisco:email_security_appliance_firmware:11.0.0-274:*:*:*:*:*:*:* | 11.0.0-274 | Vulnerable | Cisco |
| cpe:2.3:h:cisco:email_security_appliance_c160:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:email_security_appliance_c170:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:email_security_appliance_c190:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:email_security_appliance_c370:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:email_security_appliance_c370d:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:email_security_appliance_c380:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:email_security_appliance_c390:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
- cpe:2.3:o:cisco:email_security_appliance_firmware:9.8.0-112:*:*:*:*:*:*:* Versions 9.8.0-112 Vulnerable ·Cisco
- cpe:2.3:o:cisco:email_security_appliance_firmware:10.0.1-087:*:*:*:*:*:*:* Versions 10.0.1-087 Vulnerable ·Cisco
- cpe:2.3:o:cisco:email_security_appliance_firmware:11.0.0-274:*:*:*:*:*:*:* Versions 11.0.0-274 Vulnerable ·Cisco
- cpe:2.3:h:cisco:email_security_appliance_c160:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:email_security_appliance_c170:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:email_security_appliance_c190:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:email_security_appliance_c370:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:email_security_appliance_c370d:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:email_security_appliance_c380:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:email_security_appliance_c390:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
Show 14 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:h:cisco:email_security_appliance_c670:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:email_security_appliance_c680:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:email_security_appliance_c690:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:email_security_appliance_c690x:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:email_security_appliance_x1070:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:o:cisco:content_security_management_appliance:10.0.0-096:*:*:*:*:*:*:* | 10.0.0-096 | Vulnerable | Cisco |
| cpe:2.3:o:cisco:content_security_management_appliance:10.1.0-037:*:*:*:*:*:*:* | 10.1.0-037 | Vulnerable | Cisco |
| cpe:2.3:o:cisco:content_security_management_appliance:10.1.0-052:*:*:*:*:*:*:* | 10.1.0-052 | Vulnerable | Cisco |
| cpe:2.3:o:cisco:content_security_management_appliance:11.0.0-115:*:*:*:*:*:*:* | 11.0.0-115 | Vulnerable | Cisco |
| cpe:2.3:h:cisco:content_security_management_appliance_sma_m190:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:content_security_management_appliance_sma_m390:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:content_security_management_appliance_sma_m390x:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:content_security_management_appliance_sma_m690:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
| cpe:2.3:h:cisco:content_security_management_appliance_sma_m690x:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Cisco |
- cpe:2.3:h:cisco:email_security_appliance_c670:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:email_security_appliance_c680:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:email_security_appliance_c690:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:email_security_appliance_c690x:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:email_security_appliance_x1070:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:o:cisco:content_security_management_appliance:10.0.0-096:*:*:*:*:*:*:* Versions 10.0.0-096 Vulnerable ·Cisco
- cpe:2.3:o:cisco:content_security_management_appliance:10.1.0-037:*:*:*:*:*:*:* Versions 10.1.0-037 Vulnerable ·Cisco
- cpe:2.3:o:cisco:content_security_management_appliance:10.1.0-052:*:*:*:*:*:*:* Versions 10.1.0-052 Vulnerable ·Cisco
- cpe:2.3:o:cisco:content_security_management_appliance:11.0.0-115:*:*:*:*:*:*:* Versions 11.0.0-115 Vulnerable ·Cisco
- cpe:2.3:h:cisco:content_security_management_appliance_sma_m190:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:content_security_management_appliance_sma_m390:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:content_security_management_appliance_sma_m390x:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:content_security_management_appliance_sma_m690:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
- cpe:2.3:h:cisco:content_security_management_appliance_sma_m690x:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2018-0140
- 2026-10-03 Alias added: GHSA-w5x3-hp8j-7gh2
References
More Cisco Content Security Management Appliance vulnerabilities
- TI-2016-01993 The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other… CVSS 3.1HIGH 7.5
- TI-2014-01669 The End User Safelist/Blocklist (aka SLBL) service in Cisco AsyncOS Software for Email… CVSS 2.0HIGH 8.5
- TI-2015-05308 Cisco AsyncOS before 8.5.7-042, 9.x before 9.1.0-032, 9.1.x before 9.1.1-023, and 9.5.x… CVSS 2.0HIGH 7.8
- TI-2013-04730 The web framework on Cisco Web Security Appliance (WSA), Email Security Appliance (ESA)… CVSS 2.0HIGH 7.8
- TI-2019-01602 Cisco Email Security Appliance and Cisco Content Security Management Appliance Denial of Service Vulnerability CVSS 3.1MEDIUM 5.3
- TI-2020-02726 Cisco ESA, Cisco WSA, and Cisco SMA GUI Denial of Service Vulnerability CVSS 3.1MEDIUM 5.3
Sources
- CVE-2018-0140 · CVE Program
- CVE-2018-0140 · NVD
- FIRST EPSS
- GHSA-w5x3-hp8j-7gh2 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences