ID
VAR-202105-0628
CVE
CVE-2021-1447
TITLE
Cisco AsyncOS for Cisco Content Security Management Appliance Vulnerability in privilege management
Trust: 0.8
DESCRIPTION
A vulnerability in the user account management system of Cisco AsyncOS for Cisco Content Security Management Appliance (SMA) could allow an authenticated, local attacker to elevate their privileges to root. This vulnerability is due to a procedural flaw in the password generation algorithm. An attacker could exploit this vulnerability by enabling specific Administrator-only features and connecting to the appliance through the CLI with elevated privileges. A successful exploit could allow the attacker to execute arbitrary commands as root and access the underlying operating system. To exploit this vulnerability, the attacker must have valid Administrator credentials. Pillow is a Python-based image processing library. There is currently no information about this vulnerability, please feel free to follow CNNVD or manufacturer announcements. This appliance is mainly used to manage all policies, reports, audit information, etc. of email and web security appliances
Trust: 2.34
AFFECTED PRODUCTS
| vendor: | cisco | model: | content security management appliance | scope: | lt | version: | 13.8.1-068 | Trust: 1.0 |
| vendor: | cisco | model: | content security management appliance | scope: | lt | version: | 12.8.1-002 | Trust: 1.0 |
| vendor: | cisco | model: | content security management appliance | scope: | gte | version: | 13.0.0-249 | Trust: 1.0 |
| vendor: | シスコシステムズ | model: | cisco コンテンツ セキュリティ管理アプライアンス ソフトウェア | scope: | - | version: | - | Trust: 0.8 |
| vendor: | シスコシステムズ | model: | cisco コンテンツ セキュリティ管理アプライアンス ソフトウェア | scope: | eq | version: | - | Trust: 0.8 |
| vendor: | シスコシステムズ | model: | cisco コンテンツ セキュリティ管理アプライアンス ソフトウェア | scope: | eq | version: | cisco content security management appliance software | Trust: 0.8 |
CVSS
SEVERITY | CVSSV2 | CVSSV3 | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
|
PROBLEMTYPE DATA
| problemtype: | CWE-269 | Trust: 1.1 |
| problemtype: | Improper authority management (CWE-269) [ Other ] | Trust: 0.8 |
THREAT TYPE
local
Trust: 0.6
TYPE
other
Trust: 1.2
PATCH
| title: | cisco-sa-sma-priv-esc-JJ8zxQsC | url: | https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sma-priv-esc-JJ8zxQsC | Trust: 0.8 |
| title: | Cisco Content Security Management Appliance Security vulnerabilities | url: | http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=149226 | Trust: 0.6 |
| title: | Cisco: Cisco Content Security Management Appliance Privilege Escalation Vulnerability | url: | https://vulmon.com/vendoradvisory?qidtp=cisco_security_advisories_and_alerts_ciscoproducts&qid=cisco-sa-sma-priv-esc-JJ8zxQsC | Trust: 0.1 |
EXTERNAL IDS
| db: | NVD | id: | CVE-2021-1447 | Trust: 3.4 |
| db: | JVNDB | id: | JVNDB-2021-006609 | Trust: 0.8 |
| db: | CNNVD | id: | CNNVD-202105-196 | Trust: 0.7 |
| db: | CS-HELP | id: | SB2021041363 | Trust: 0.6 |
| db: | CNNVD | id: | CNNVD-202104-975 | Trust: 0.6 |
| db: | CS-HELP | id: | SB2021050612 | Trust: 0.6 |
| db: | AUSCERT | id: | ESB-2021.1551 | Trust: 0.6 |
| db: | VULHUB | id: | VHN-374501 | Trust: 0.1 |
| db: | VULMON | id: | CVE-2021-1447 | Trust: 0.1 |
REFERENCES
| url: | https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-sma-priv-esc-jj8zxqsc | Trust: 2.5 |
| url: | https://nvd.nist.gov/vuln/detail/cve-2021-1447 | Trust: 0.8 |
| url: | https://www.cybersecurity-help.cz/vdb/sb2021041363 | Trust: 0.6 |
| url: | https://www.cybersecurity-help.cz/vdb/sb2021050612 | Trust: 0.6 |
| url: | https://www.auscert.org.au/bulletins/esb-2021.1551 | Trust: 0.6 |
| url: | https://vigilance.fr/vulnerability/cisco-content-security-management-appliance-privilege-escalation-35264 | Trust: 0.6 |
| url: | https://cwe.mitre.org/data/definitions/269.html | Trust: 0.1 |
| url: | https://nvd.nist.gov | Trust: 0.1 |
SOURCES
| db: | VULHUB | id: | VHN-374501 |
| db: | VULMON | id: | CVE-2021-1447 |
| db: | JVNDB | id: | JVNDB-2021-006609 |
| db: | CNNVD | id: | CNNVD-202104-975 |
| db: | CNNVD | id: | CNNVD-202105-196 |
| db: | NVD | id: | CVE-2021-1447 |
LAST UPDATE DATE
2024-08-14T12:22:19.735000+00:00
SOURCES UPDATE DATE
| db: | VULHUB | id: | VHN-374501 | date: | 2021-05-14T00:00:00 |
| db: | VULMON | id: | CVE-2021-1447 | date: | 2021-05-14T00:00:00 |
| db: | JVNDB | id: | JVNDB-2021-006609 | date: | 2022-01-14T03:03:00 |
| db: | CNNVD | id: | CNNVD-202104-975 | date: | 2021-04-14T00:00:00 |
| db: | CNNVD | id: | CNNVD-202105-196 | date: | 2021-05-18T00:00:00 |
| db: | NVD | id: | CVE-2021-1447 | date: | 2023-11-07T03:28:20.010 |
SOURCES RELEASE DATE
| db: | VULHUB | id: | VHN-374501 | date: | 2021-05-06T00:00:00 |
| db: | VULMON | id: | CVE-2021-1447 | date: | 2021-05-06T00:00:00 |
| db: | JVNDB | id: | JVNDB-2021-006609 | date: | 2022-01-14T00:00:00 |
| db: | CNNVD | id: | CNNVD-202104-975 | date: | 2021-04-13T00:00:00 |
| db: | CNNVD | id: | CNNVD-202105-196 | date: | 2021-05-05T00:00:00 |
| db: | NVD | id: | CVE-2021-1447 | date: | 2021-05-06T13:15:10.293 |