Sign-up

ID

VAR-202105-0447


CVE

CVE-2021-1284


TITLE

Cisco SD-WAN vManage  Software access control vulnerabilities

Trust: 0.8

sources: JVNDB: JVNDB-2021-006597

DESCRIPTION

A vulnerability in the web-based messaging service interface of Cisco SD-WAN vManage Software could allow an unauthenticated, adjacent attacker to bypass authentication and authorization and modify the configuration of an affected system. To exploit this vulnerability, the attacker must be able to access an associated Cisco SD-WAN vEdge device. This vulnerability is due to insufficient authorization checks. An attacker could exploit this vulnerability by sending crafted HTTP requests to the web-based messaging service interface of an affected system. A successful exploit could allow the attacker to gain unauthenticated read and write access to the affected vManage system. With this access, the attacker could access information about the affected vManage system, modify the configuration of the system, or make configuration changes to devices that are managed by the system. Cisco SD-WAN vManage The software contains a vulnerability related to access control.Information is obtained, information is tampered with, and service is disrupted (DoS) It may be put into a state. Pillow is a Python-based image processing library. There is currently no information about this vulnerability, please feel free to follow CNNVD or manufacturer announcements. Cisco SD-WAN vManage is a software from Cisco that provides software-defined network functions. The software is a form of network virtualization

Trust: 2.34

sources: NVD: CVE-2021-1284 // JVNDB: JVNDB-2021-006597 // CNNVD: CNNVD-202104-975 // VULHUB: VHN-374338 // VULMON: CVE-2021-1284

AFFECTED PRODUCTS

vendor:ciscomodel:catalyst sd-wan managerscope:ltversion:20.4.1

Trust: 1.0

vendor:ciscomodel:sd-wan vmanagescope:ltversion:20.3.1

Trust: 1.0

vendor:ciscomodel:catalyst sd-wan managerscope:ltversion:20.5.1

Trust: 1.0

vendor:ciscomodel:catalyst sd-wan managerscope:gteversion:20.4

Trust: 1.0

vendor:ciscomodel:catalyst sd-wan managerscope:gteversion:20.5

Trust: 1.0

vendor:シスコシステムズmodel:cisco sd-wan vmanagescope:eqversion: -

Trust: 0.8

vendor:シスコシステムズmodel:cisco sd-wan vmanagescope: - version: -

Trust: 0.8

sources: JVNDB: JVNDB-2021-006597 // NVD: CVE-2021-1284

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2021-1284
value: HIGH

Trust: 1.0

ykramarz@cisco.com: CVE-2021-1284
value: HIGH

Trust: 1.0

NVD: CVE-2021-1284
value: HIGH

Trust: 0.8

CNNVD: CNNVD-202104-975
value: MEDIUM

Trust: 0.6

CNNVD: CNNVD-202105-146
value: HIGH

Trust: 0.6

VULHUB: VHN-374338
value: MEDIUM

Trust: 0.1

VULMON: CVE-2021-1284
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2021-1284
severity: MEDIUM
baseScore: 5.8
vectorString: AV:A/AC:L/AU:N/C:P/I:P/A:P
accessVector: ADJACENT_NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 6.5
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

VULHUB: VHN-374338
severity: MEDIUM
baseScore: 5.8
vectorString: AV:A/AC:L/AU:N/C:P/I:P/A:P
accessVector: ADJACENT_NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 6.5
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2021-1284
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: ADJACENT
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.8
impactScore: 5.9
version: 3.1

Trust: 2.0

NVD: CVE-2021-1284
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: ADJACENT NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: VULHUB: VHN-374338 // VULMON: CVE-2021-1284 // JVNDB: JVNDB-2021-006597 // CNNVD: CNNVD-202104-975 // CNNVD: CNNVD-202105-146 // NVD: CVE-2021-1284 // NVD: CVE-2021-1284

PROBLEMTYPE DATA

problemtype:NVD-CWE-Other

Trust: 1.0

problemtype:CWE-284

Trust: 1.0

problemtype:Inappropriate access control (CWE-284) [ Other ]

Trust: 0.8

sources: JVNDB: JVNDB-2021-006597 // NVD: CVE-2021-1284

THREAT TYPE

remote or local

Trust: 0.6

sources: CNNVD: CNNVD-202105-146

TYPE

other

Trust: 1.2

sources: CNNVD: CNNVD-202104-975 // CNNVD: CNNVD-202105-146

PATCH

title:cisco-sa-sdw-auth-bypass-65aYqcS2url:https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdw-auth-bypass-65aYqcS2

Trust: 0.8

title:Cisco SD-WAN vManage Fixes for access control error vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=150784

Trust: 0.6

title:Cisco: Cisco SD-WAN vManage Software Authentication Bypass Vulnerabilityurl:https://vulmon.com/vendoradvisory?qidtp=cisco_security_advisories_and_alerts_ciscoproducts&qid=cisco-sa-sdw-auth-bypass-65aYqcS2

Trust: 0.1

sources: VULMON: CVE-2021-1284 // JVNDB: JVNDB-2021-006597 // CNNVD: CNNVD-202105-146

EXTERNAL IDS

db:NVDid:CVE-2021-1284

Trust: 3.4

db:JVNDBid:JVNDB-2021-006597

Trust: 0.8

db:CS-HELPid:SB2021041363

Trust: 0.6

db:CNNVDid:CNNVD-202104-975

Trust: 0.6

db:AUSCERTid:ESB-2021.1534

Trust: 0.6

db:CS-HELPid:SB2021050616

Trust: 0.6

db:CNNVDid:CNNVD-202105-146

Trust: 0.6

db:VULHUBid:VHN-374338

Trust: 0.1

db:VULMONid:CVE-2021-1284

Trust: 0.1

sources: VULHUB: VHN-374338 // VULMON: CVE-2021-1284 // JVNDB: JVNDB-2021-006597 // CNNVD: CNNVD-202104-975 // CNNVD: CNNVD-202105-146 // NVD: CVE-2021-1284

REFERENCES

url:https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-sdw-auth-bypass-65ayqcs2

Trust: 2.5

url:https://nvd.nist.gov/vuln/detail/cve-2021-1284

Trust: 0.8

url:https://www.cybersecurity-help.cz/vdb/sb2021041363

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2021.1534

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2021050616

Trust: 0.6

url:https://cwe.mitre.org/data/definitions/284.html

Trust: 0.1

url:https://nvd.nist.gov

Trust: 0.1

sources: VULHUB: VHN-374338 // VULMON: CVE-2021-1284 // JVNDB: JVNDB-2021-006597 // CNNVD: CNNVD-202104-975 // CNNVD: CNNVD-202105-146 // NVD: CVE-2021-1284

SOURCES

db:VULHUBid:VHN-374338
db:VULMONid:CVE-2021-1284
db:JVNDBid:JVNDB-2021-006597
db:CNNVDid:CNNVD-202104-975
db:CNNVDid:CNNVD-202105-146
db:NVDid:CVE-2021-1284

LAST UPDATE DATE

2024-08-14T12:59:26.825000+00:00


SOURCES UPDATE DATE

db:VULHUBid:VHN-374338date:2022-08-05T00:00:00
db:VULMONid:CVE-2021-1284date:2021-05-14T00:00:00
db:JVNDBid:JVNDB-2021-006597date:2022-01-14T03:02:00
db:CNNVDid:CNNVD-202104-975date:2021-04-14T00:00:00
db:CNNVDid:CNNVD-202105-146date:2022-08-10T00:00:00
db:NVDid:CVE-2021-1284date:2023-11-07T03:27:52.397

SOURCES RELEASE DATE

db:VULHUBid:VHN-374338date:2021-05-06T00:00:00
db:VULMONid:CVE-2021-1284date:2021-05-06T00:00:00
db:JVNDBid:JVNDB-2021-006597date:2022-01-14T00:00:00
db:CNNVDid:CNNVD-202104-975date:2021-04-13T00:00:00
db:CNNVDid:CNNVD-202105-146date:2021-05-05T00:00:00
db:NVDid:CVE-2021-1284date:2021-05-06T13:15:09.857