CVE-2019-12635: cisco cisco content security management appliance (sma) Improper Authorization

Vulnerability summary

CVE-2019-12635 is a medium (CVSS 4.3) Improper Authorization vulnerability in cisco cisco content security management appliance (sma). EPSS estimates a 1.02% chance of exploitation in the next 30 days, higher than 63% of scored vulnerabilities.

Timeline

1. 05-09-2019
   PublishedVulnerability first disclosed.
2. 21-11-2024
   Last modifiedVulnerability information updated.

Description

A vulnerability in the authorization module of Cisco Content Security Management Appliance (SMA) Software could allow an authenticated, remote attacker to gain out-of-scope access to email. The vulnerability exists because the affected software does not correctly implement role permission controls. An attacker could exploit this vulnerability by using a custom role with specific permissions. A successful exploit could allow the attacker to access the spam quarantine of other users.

• CWE-285Improper AuthorizationThe product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
• CWE-732Incorrect Permission Assignment for Critical ResourceThe product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.