CVE-2017-12309 (CNNVD-201711-672)
中文标题:
Cisco Email Security Appliance 安全漏洞
英文标题:
A vulnerability in the Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote a...
漏洞描述
中文描述:
Cisco Email Security Appliance（ESA）是美国思科（Cisco）公司的一套电子邮件安全设备。该设备提供垃圾邮件保护、邮件加密、数据丢失防护等功能。 Cisco ESA中存在HTTP响应拆分漏洞，该漏洞应用程序或环境没有正确的过滤输入值。远程攻击者可通过注入恶意的HTTP包头，控制响应主体或将相应拆分成多个响应利用该漏洞实施跨站脚本攻击，跨用户污损攻击或Web缓存中毒攻击。
英文描述:
A vulnerability in the Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to conduct a HTTP response splitting attack. The vulnerability is due to the failure of the application or its environment to properly sanitize input values. An attacker could exploit this vulnerability by injecting malicious HTTP headers, controlling the response body, or splitting the response into multiple responses. An exploit could allow the attacker to perform cross-site scripting attacks, cross-user defacement, web cache poisoning, and similar exploits. Cisco Bug IDs: CSCvf16705.
CWE类型:
标签:
受影响产品
| 厂商 | 产品 | 版本 | 版本范围 | 平台 | CPE |
|---|---|---|---|---|---|
| cisco | email_security_appliance_firmware | 10.0.2-020 | - | - |
cpe:2.3:o:cisco:email_security_appliance_firmware:10.0.2-020:*:*:*:*:*:*:*
|
| cisco | email_security_appliance_firmware | 11.0.0-105 | - | - |
cpe:2.3:o:cisco:email_security_appliance_firmware:11.0.0-105:*:*:*:*:*:*:*
|
解决方案
中文解决方案:
英文解决方案:
临时解决方案:
CVSS评分详情
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
时间信息
利用信息
数据源详情
| 数据源 | 记录ID | 版本 | 提取时间 |
|---|---|---|---|
| CVE | cve_CVE-2017-12309 |
2025-11-11 15:19:17 | 2025-11-11 07:34:33 |
| NVD | nvd_CVE-2017-12309 |
2025-11-11 14:55:33 | 2025-11-11 07:43:12 |
| CNNVD | cnnvd_CNNVD-201711-672 |
2025-11-11 15:09:55 | 2025-11-11 07:53:25 |
版本与语言
安全公告
变更历史
查看详细变更
- vulnerability_type: 未提取 -> 注入
- cnnvd_id: 未提取 -> CNNVD-201711-672
- data_sources: ['cve', 'nvd'] -> ['cnnvd', 'cve', 'nvd']
查看详细变更
- cvss_score: 未提取 -> 5.3
- cvss_vector: NOT_EXTRACTED -> CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- cvss_version: NOT_EXTRACTED -> 3.0
- affected_products_count: 0 -> 2
- data_sources: ['cve'] -> ['cve', 'nvd']