CVE-2020-3134CWE-20

Cisco Email Security Appliance Zip Decompression Engine Denial of Service Vulnerability

Medium · published January 26, 2020

CVSS v3.0
6.5
EPSS
1%
Percentile
65.0
In the wild
Unconfirmed
What it is

A vulnerability in the zip decompression engine of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to improper validation of zip files. An attacker could exploit this vulnerability by sending an email message with a crafted zip-compressed attachment. A successful exploit could trigger a restart of the content-scanning process, causing a temporary DoS condition. This vulnerability affects Cisco AsyncOS Software for Cisco ESA releases earlier than 13.0.

The record
Technical detail
CVSS v3.0
6.5 · MEDIUM
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.01087 · 65.0th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2020-01-26T04:31Z
EPSS history
Timeline
  • 26 JAN 04:31Z
    Cisco Email Security Appliance Zip Decompression Engine Denial of Service Vulnerability
    cvelistv5