CVE Vulnerability

CVE-2021-1259

A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to conduct path traversal attacks and obtain write access to sensitive files on an affected system. The vulnerability is due to insufficient validation of HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request that contains directory traversal character sequences to an affected system. A successful exploit could allow the attacker to write arbitrary files on the affected system.

6.8 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 8 / Impact : 6.9

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact NONE

Integrity Impact COMPLETE

Availability Impact NONE

Scope

6.5 /10

CVSS v3.0 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vman-pathtrav-Z5mCVsjf Vendor Advisory
Configurations

Configuration 1

cpe:2.3:a:cisco:sd-wan_vmanage:*:*:*:*:*:*:*:*
Information

Published : 2021-01-20 08:15

Updated : 2021-01-29 03:15

NVD link : CVE-2021-1259

Mitre link : CVE-2021-1259

Products Affected
No products.
CWE
CWE-22