CVE-2017-12309

A vulnerability in the Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to conduct a HTTP response splitting attack. The vulnerability is due to the failure of the application or its environment to properly sanitize input values. An attacker could exploit this vulnerability by injecting malicious HTTP headers, controlling the response body, or splitting the response into multiple responses. An exploit could allow the attacker to perform cross-site scripting attacks, cross-user defacement, web cache poisoning, and similar exploits. Cisco Bug IDs: CSCvf16705.

• CWE-113
• CWE-113

• http://www.securityfocus.com/bid/101928Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1039831Third Party Advisory, VDB Entry
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171115-esaVendor Advisory
• http://www.securityfocus.com/bid/101928Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1039831Third Party Advisory, VDB Entry
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171115-esaVendor Advisory

Published

Nov 16, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-12303A vulnerability in the Advanced Malware Protection (AMP) fil…
• CVE-2017-12304A vulnerability in the IOS daemon (IOSd) web-based managemen…
• CVE-2017-12305A vulnerability in the debug interface of Cisco IP Phone 880…
• CVE-2017-12306A vulnerability in the upgrade process of Cisco Spark Board …
• CVE-2017-12307A vulnerability in the web framework of Cisco Small Business…6.1
• CVE-2017-12308A vulnerability in the web framework of Cisco Small Business…6.1
• CVE-2017-1231IBM BigFix Platform 9.5 - 9.5.9 stores user credentials in p…4.4
• CVE-2017-12310A vulnerability in the auto discovery phase of Cisco Spark H…
• CVE-2017-12311A vulnerability in the H.264 decoder function of Cisco Meeti…
• CVE-2017-12312An untrusted search path (aka DLL Preloading) vulnerability …
• CVE-2017-12313An untrusted search path (aka DLL Preload) vulnerability in …
• CVE-2017-12314A vulnerability in the Cisco FindIT Network Discovery Utilit…