Details of VAR-202106-0493

ID

VAR-202106-0493

CVE

CVE-2021-1134

TITLE

Pillow Buffer error vulnerability

Trust: 0.6

sources: CNNVD: CNNVD-202104-975

DESCRIPTION

A vulnerability in the Cisco Identity Services Engine (ISE) integration feature of the Cisco DNA Center Software could allow an unauthenticated, remote attacker to gain unauthorized access to sensitive data. The vulnerability is due to an incomplete validation of the X.509 certificate used when establishing a connection between DNA Center and an ISE server. An attacker could exploit this vulnerability by supplying a crafted certificate and could then intercept communications between the ISE and DNA Center. A successful exploit could allow the attacker to view and alter sensitive information that the ISE maintains about clients that are connected to the network. Pillow is a Python-based image processing library. There is currently no information about this vulnerability, please feel free to follow CNNVD or manufacturer announcements. Cisco DNA Center is a network management and command center service of Cisco (Cisco)

Trust: 1.53

sources: NVD: CVE-2021-1134 // CNNVD: CNNVD-202104-975 // VULHUB: VHN-374188

AFFECTED PRODUCTS

vendor:

cisco

model:

dna center

scope:

version:

2.2.2.1

Trust: 1.0

sources: NVD: CVE-2021-1134

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2021-1134
value:	HIGH
Trust: 1.0
ykramarz@cisco.com:	CVE-2021-1134
value:	HIGH
Trust: 1.0
CNNVD:	CNNVD-202104-975
value:	MEDIUM
Trust: 0.6
CNNVD:	CNNVD-202106-1340
value:	HIGH
Trust: 0.6
VULHUB:	VHN-374188
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2021-1134
severity:	MEDIUM
baseScore:	5.8
vectorString:	AV:N/AC:M/AU:N/C:P/I:P/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	8.6
impactScore:	4.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.0
VULHUB:	VHN-374188
severity:	MEDIUM
baseScore:	5.8
vectorString:	AV:N/AC:M/AU:N/C:P/I:P/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	8.6
impactScore:	4.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2021-1134
baseSeverity:	HIGH
baseScore:	7.4
vectorString:	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
attackVector:	NETWORK
attackComplexity:	HIGH
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	NONE
exploitabilityScore:	2.2
impactScore:	5.2
version:	3.1
Trust: 1.0
ykramarz@cisco.com:	CVE-2021-1134
baseSeverity:	HIGH
baseScore:	7.4
vectorString:	CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
attackVector:	NETWORK
attackComplexity:	HIGH
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	NONE
exploitabilityScore:	2.2
impactScore:	5.2
version:	3.0
Trust: 1.0

sources: VULHUB: VHN-374188 // CNNVD: CNNVD-202104-975 // CNNVD: CNNVD-202106-1340 // NVD: CVE-2021-1134 // NVD: CVE-2021-1134

PROBLEMTYPE DATA

problemtype:

CWE-295

Trust: 1.1

sources: VULHUB: VHN-374188 // NVD: CVE-2021-1134

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202106-1340

TYPE

other

Trust: 0.6

sources: CNNVD: CNNVD-202104-975

PATCH

title:

Cisco DNA Center Repair measures for trust management problem vulnerabilities

url:

http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=155893

Trust: 0.6

sources: CNNVD: CNNVD-202106-1340

EXTERNAL IDS

db:	NVD	id:	CVE-2021-1134	Trust: 1.7
db:	CNNVD	id:	CNNVD-202106-1340	Trust: 0.7
db:	CS-HELP	id:	SB2021041363	Trust: 0.6
db:	CNNVD	id:	CNNVD-202104-975	Trust: 0.6
db:	CS-HELP	id:	SB2021061706	Trust: 0.6
db:	AUSCERT	id:	ESB-2021.2146	Trust: 0.6
db:	VULHUB	id:	VHN-374188	Trust: 0.1

sources: VULHUB: VHN-374188 // CNNVD: CNNVD-202104-975 // CNNVD: CNNVD-202106-1340 // NVD: CVE-2021-1134

REFERENCES

url:	https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-dnac-certvalid-usej2czk	Trust: 1.7
url:	https://www.cybersecurity-help.cz/vdb/sb2021041363	Trust: 0.6
url:	https://www.auscert.org.au/bulletins/esb-2021.2146	Trust: 0.6
url:	https://www.cybersecurity-help.cz/vdb/sb2021061706	Trust: 0.6

sources: VULHUB: VHN-374188 // CNNVD: CNNVD-202104-975 // CNNVD: CNNVD-202106-1340 // NVD: CVE-2021-1134

SOURCES

db:	VULHUB	id:	VHN-374188
db:	CNNVD	id:	CNNVD-202104-975
db:	CNNVD	id:	CNNVD-202106-1340
db:	NVD	id:	CVE-2021-1134

LAST UPDATE DATE

2024-08-14T12:18:38.611000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-374188	date:	2021-07-02T00:00:00
db:	CNNVD	id:	CNNVD-202104-975	date:	2021-04-14T00:00:00
db:	CNNVD	id:	CNNVD-202106-1340	date:	2021-07-05T00:00:00
db:	NVD	id:	CVE-2021-1134	date:	2021-07-02T15:34:48.493

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-374188	date:	2021-06-29T00:00:00
db:	CNNVD	id:	CNNVD-202104-975	date:	2021-04-13T00:00:00
db:	CNNVD	id:	CNNVD-202106-1340	date:	2021-06-16T00:00:00
db:	NVD	id:	CVE-2021-1134	date:	2021-06-29T03:15:06.890