CVE-2016-1423

Vulnerability

The vulnerability resides in the Messages in Quarantine (MIQ) view of Cisco AsyncOS for Cisco Email Security Appliance (ESA). The software fails to properly sanitize HTML script tags in quarantined email messages, allowing an attacker to inject malicious content. Affected versions include release 8.0.2-069 and all prior releases. Fixed versions are 9.1.1-038 and 9.7.2-047 [1].

Exploitation

An unauthenticated, remote attacker can exploit this vulnerability by sending a crafted email message containing malformed HTML script tags to the affected ESA. When an administrator or user views the quarantined message in the MIQ view, the malicious script executes, potentially tricking the user into clicking a crafted link. No authentication or special network position is required beyond the ability to send email to the appliance [1].

Impact

Successful exploitation allows the attacker to perform cross-site scripting (XSS) or HTML injection attacks within the MIQ view. This could lead to session hijacking, defacement, or redirection to malicious sites, compromising the confidentiality and integrity of the user's interaction with the appliance [1].

Mitigation

Cisco has released software updates to address this vulnerability: versions 9.1.1-038 and 9.7.2-047 for ESA. No workarounds are available. Users should upgrade to a fixed release as soon as possible [1].