Details of VAR-202106-0905

ID

VAR-202106-0905

CVE

CVE-2021-1538

TITLE

Cisco Common Services Platform Collector In OS Command injection vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2021-001955

DESCRIPTION

A vulnerability in the configuration dashboard of Cisco Common Services Platform Collector (CSPC) could allow an authenticated, remote attacker to execute arbitrary code. This vulnerability is due to insufficient sanitization of configuration entries. An attacker could exploit this vulnerability by logging in as a super admin and entering crafted input to configuration options on the CSPC configuration dashboard. A successful exploit could allow the attacker to execute remote code as root. Pillow is a Python-based image processing library. There is currently no information about this vulnerability, please feel free to follow CNNVD or manufacturer announcements. The product analyzes network performance and identifies risks and vulnerabilities by polling Cisco devices for basic inventory and configuration data

Trust: 2.25

sources: NVD: CVE-2021-1538 // JVNDB: JVNDB-2021-001955 // CNNVD: CNNVD-202104-975 // VULHUB: VHN-374592

AFFECTED PRODUCTS

vendor:	cisco	model:	common services platform collector	scope:	lt	version:	2.9.1	Trust: 1.0
vendor:	シスコシステムズ	model:	cisco common services platform collector	scope:	eq	version:	-	Trust: 0.8
vendor:	シスコシステムズ	model:	cisco common services platform collector	scope:	-	version:	-	Trust: 0.8

sources: JVNDB: JVNDB-2021-001955 // NVD: CVE-2021-1538

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2021-1538
value:	HIGH
Trust: 1.0
ykramarz@cisco.com:	CVE-2021-1538
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2021-1538
value:	HIGH
Trust: 0.8
CNNVD:	CNNVD-202104-975
value:	MEDIUM
Trust: 0.6
CNNVD:	CNNVD-202106-123
value:	HIGH
Trust: 0.6
VULHUB:	VHN-374592
value:	HIGH
Trust: 0.1

nvd@nist.gov:	CVE-2021-1538
severity:	HIGH
baseScore:	9.0
vectorString:	AV:N/AC:L/AU:S/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	8.0
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
VULHUB:	VHN-374592
severity:	HIGH
baseScore:	9.0
vectorString:	AV:N/AC:L/AU:S/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	8.0
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2021-1538
baseSeverity:	HIGH
baseScore:	7.2
vectorString:	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	HIGH
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	1.2
impactScore:	5.9
version:	3.1
Trust: 1.0
ykramarz@cisco.com:	CVE-2021-1538
baseSeverity:	MEDIUM
baseScore:	4.7
vectorString:	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	HIGH
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	LOW
integrityImpact:	LOW
availabilityImpact:	LOW
exploitabilityScore:	1.2
impactScore:	3.4
version:	3.1
Trust: 1.0
NVD:	CVE-2021-1538
baseSeverity:	HIGH
baseScore:	7.2
vectorString:	CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	HIGH
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: VULHUB: VHN-374592 // JVNDB: JVNDB-2021-001955 // CNNVD: CNNVD-202104-975 // CNNVD: CNNVD-202106-123 // NVD: CVE-2021-1538 // NVD: CVE-2021-1538

PROBLEMTYPE DATA

problemtype:	CWE-78	Trust: 1.1
problemtype:	OS Command injection (CWE-78) [ Other ]	Trust: 0.8

sources: VULHUB: VHN-374592 // JVNDB: JVNDB-2021-001955 // NVD: CVE-2021-1538

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202106-123

TYPE

other

Trust: 0.6

sources: CNNVD: CNNVD-202104-975

PATCH

title:

cisco-sa-CSPC-CIV-kDuBfNfu

url:

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-CSPC-CIV-kDuBfNfu

Trust: 0.8

sources: JVNDB: JVNDB-2021-001955

EXTERNAL IDS

db:	NVD	id:	CVE-2021-1538	Trust: 2.5
db:	JVNDB	id:	JVNDB-2021-001955	Trust: 0.8
db:	CS-HELP	id:	SB2021041363	Trust: 0.6
db:	CNNVD	id:	CNNVD-202104-975	Trust: 0.6
db:	CS-HELP	id:	SB2021060304	Trust: 0.6
db:	AUSCERT	id:	ESB-2021.1904	Trust: 0.6
db:	CNNVD	id:	CNNVD-202106-123	Trust: 0.6
db:	VULHUB	id:	VHN-374592	Trust: 0.1

sources: VULHUB: VHN-374592 // JVNDB: JVNDB-2021-001955 // CNNVD: CNNVD-202104-975 // CNNVD: CNNVD-202106-123 // NVD: CVE-2021-1538

REFERENCES

url:	https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-cspc-civ-kdubfnfu	Trust: 1.7
url:	https://nvd.nist.gov/vuln/detail/cve-2021-1538	Trust: 1.4
url:	https://www.cybersecurity-help.cz/vdb/sb2021041363	Trust: 0.6
url:	https://www.auscert.org.au/bulletins/esb-2021.1904	Trust: 0.6
url:	https://www.cybersecurity-help.cz/vdb/sb2021060304	Trust: 0.6

sources: VULHUB: VHN-374592 // JVNDB: JVNDB-2021-001955 // CNNVD: CNNVD-202104-975 // CNNVD: CNNVD-202106-123 // NVD: CVE-2021-1538

SOURCES

db:	VULHUB	id:	VHN-374592
db:	JVNDB	id:	JVNDB-2021-001955
db:	CNNVD	id:	CNNVD-202104-975
db:	CNNVD	id:	CNNVD-202106-123
db:	NVD	id:	CVE-2021-1538

LAST UPDATE DATE

2024-08-14T12:44:23.782000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-374592	date:	2021-06-14T00:00:00
db:	JVNDB	id:	JVNDB-2021-001955	date:	2021-07-06T02:54:00
db:	CNNVD	id:	CNNVD-202104-975	date:	2021-04-14T00:00:00
db:	CNNVD	id:	CNNVD-202106-123	date:	2021-06-15T00:00:00
db:	NVD	id:	CVE-2021-1538	date:	2023-11-07T03:28:34.193

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-374592	date:	2021-06-04T00:00:00
db:	JVNDB	id:	JVNDB-2021-001955	date:	2021-07-06T00:00:00
db:	CNNVD	id:	CNNVD-202104-975	date:	2021-04-13T00:00:00
db:	CNNVD	id:	CNNVD-202106-123	date:	2021-06-02T00:00:00
db:	NVD	id:	CVE-2021-1538	date:	2021-06-04T17:15:09.550