Sign-up

ID

VAR-202101-0778


CVE

CVE-2021-1218


TITLE

Cisco Smart Software Manager Satellite  Open redirect vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2021-002789

DESCRIPTION

A vulnerability in the web management interface of Cisco Smart Software Manager satellite could allow an authenticated, remote attacker to redirect a user to an undesired web page. The vulnerability is due to improper input validation of the URL parameters in an HTTP request that is sent to an affected device. An attacker could exploit this vulnerability by sending a crafted HTTP request that could cause the web application to redirect the request to a specified malicious URL. A successful exploit could allow the attacker to redirect a user to a malicious website. The software eliminates cumbersome product activation key (PAK) and license file management, makes the license node no longer locked to the device, and can support the license to be used on any compatible device

Trust: 1.8

sources: NVD: CVE-2021-1218 // JVNDB: JVNDB-2021-002789 // VULHUB: VHN-374272 // VULMON: CVE-2021-1218

AFFECTED PRODUCTS

vendor:ciscomodel:smart software manager on-premscope:lteversion:5.0

Trust: 1.0

vendor:シスコシステムズmodel:cisco smart software manager on-premscope: - version: -

Trust: 0.8

vendor:シスコシステムズmodel:cisco smart software manager on-premscope:eqversion: -

Trust: 0.8

sources: JVNDB: JVNDB-2021-002789 // NVD: CVE-2021-1218

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2021-1218
value: MEDIUM

Trust: 1.0

ykramarz@cisco.com: CVE-2021-1218
value: MEDIUM

Trust: 1.0

NVD: CVE-2021-1218
value: MEDIUM

Trust: 0.8

CNNVD: CNNVD-202101-1521
value: MEDIUM

Trust: 0.6

VULHUB: VHN-374272
value: MEDIUM

Trust: 0.1

VULMON: CVE-2021-1218
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2021-1218
severity: MEDIUM
baseScore: 4.9
vectorString: AV:N/AC:M/AU:S/C:P/I:P/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: SINGLE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 6.8
impactScore: 4.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

VULHUB: VHN-374272
severity: MEDIUM
baseScore: 4.9
vectorString: AV:N/AC:M/AU:S/C:P/I:P/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: SINGLE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 6.8
impactScore: 4.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2021-1218
baseSeverity: MEDIUM
baseScore: 5.4
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
exploitabilityScore: 2.3
impactScore: 2.7
version: 3.1

Trust: 1.0

ykramarz@cisco.com: CVE-2021-1218
baseSeverity: MEDIUM
baseScore: 4.6
vectorString: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
exploitabilityScore: 2.1
impactScore: 2.5
version: 3.0

Trust: 1.0

NVD: CVE-2021-1218
baseSeverity: MEDIUM
baseScore: 5.4
vectorString: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: VULHUB: VHN-374272 // VULMON: CVE-2021-1218 // JVNDB: JVNDB-2021-002789 // CNNVD: CNNVD-202101-1521 // NVD: CVE-2021-1218 // NVD: CVE-2021-1218

PROBLEMTYPE DATA

problemtype:CWE-601

Trust: 1.1

problemtype:Open redirect (CWE-601) [ Other ]

Trust: 0.8

sources: VULHUB: VHN-374272 // JVNDB: JVNDB-2021-002789 // NVD: CVE-2021-1218

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202101-1521

TYPE

input validation error

Trust: 0.6

sources: CNNVD: CNNVD-202101-1521

PATCH

title:cisco-sa-cssmor-MDCWkT2xurl:https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cssmor-MDCWkT2x

Trust: 0.8

title:Cisco Smart Software Manager satelite Enter the fix for the verification error vulnerabilityurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=139784

Trust: 0.6

title:Cisco: Cisco Smart Software Manager Satellite Open Redirect Vulnerabilityurl:https://vulmon.com/vendoradvisory?qidtp=cisco_security_advisories_and_alerts_ciscoproducts&qid=cisco-sa-cssmor-MDCWkT2x

Trust: 0.1

sources: VULMON: CVE-2021-1218 // JVNDB: JVNDB-2021-002789 // CNNVD: CNNVD-202101-1521

EXTERNAL IDS

db:NVDid:CVE-2021-1218

Trust: 2.6

db:JVNDBid:JVNDB-2021-002789

Trust: 0.8

db:AUSCERTid:ESB-2021.0240

Trust: 0.6

db:CNNVDid:CNNVD-202101-1521

Trust: 0.6

db:VULHUBid:VHN-374272

Trust: 0.1

db:VULMONid:CVE-2021-1218

Trust: 0.1

sources: VULHUB: VHN-374272 // VULMON: CVE-2021-1218 // JVNDB: JVNDB-2021-002789 // CNNVD: CNNVD-202101-1521 // NVD: CVE-2021-1218

REFERENCES

url:https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-cssmor-mdcwkt2x

Trust: 2.5

url:https://nvd.nist.gov/vuln/detail/cve-2021-1218

Trust: 1.4

url:https://www.auscert.org.au/bulletins/esb-2021.0240/

Trust: 0.6

url:https://cwe.mitre.org/data/definitions/601.html

Trust: 0.1

url:https://nvd.nist.gov

Trust: 0.1

sources: VULHUB: VHN-374272 // VULMON: CVE-2021-1218 // JVNDB: JVNDB-2021-002789 // CNNVD: CNNVD-202101-1521 // NVD: CVE-2021-1218

SOURCES

db:VULHUBid:VHN-374272
db:VULMONid:CVE-2021-1218
db:JVNDBid:JVNDB-2021-002789
db:CNNVDid:CNNVD-202101-1521
db:NVDid:CVE-2021-1218

LAST UPDATE DATE

2024-08-14T13:24:00.428000+00:00


SOURCES UPDATE DATE

db:VULHUBid:VHN-374272date:2021-01-28T00:00:00
db:VULMONid:CVE-2021-1218date:2021-01-28T00:00:00
db:JVNDBid:JVNDB-2021-002789date:2021-10-01T08:56:00
db:CNNVDid:CNNVD-202101-1521date:2021-02-01T00:00:00
db:NVDid:CVE-2021-1218date:2021-01-28T17:48:53.157

SOURCES RELEASE DATE

db:VULHUBid:VHN-374272date:2021-01-20T00:00:00
db:VULMONid:CVE-2021-1218date:2021-01-20T00:00:00
db:JVNDBid:JVNDB-2021-002789date:2021-10-01T00:00:00
db:CNNVDid:CNNVD-202101-1521date:2021-01-20T00:00:00
db:NVDid:CVE-2021-1218date:2021-01-20T21:15:11.617