CVE-2021-1491

{"id": "CVE-2021-1491", "cveTags": [], "metrics": {"cvssMetricV30": [{"type": "Secondary", "source": "ykramarz@cisco.com", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2024-11-15T17:15:09.220", "references": [{"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vmanage-info-disclos-gGvm9Mfu", "source": "ykramarz@cisco.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Primary", "source": "ykramarz@cisco.com", "description": [{"lang": "en", "value": "CWE-59"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to read arbitrary files on the underlying file system of the device.\r\nThis vulnerability is due to insufficient file scope limiting. An attacker could exploit this vulnerability by creating a specific file reference on the file system and then accessing it through the web-based management interface. A successful exploit could allow the attacker to read arbitrary files from the file system of the underlying operating system.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability."}, {"lang": "es", "value": "Una vulnerabilidad en la interfaz de administraci\u00f3n basada en web del software Cisco SD-WAN vManage podr\u00eda permitir que un atacante remoto autenticado lea archivos arbitrarios en el sistema de archivos subyacente del dispositivo. Esta vulnerabilidad se debe a una limitaci\u00f3n insuficiente del alcance de los archivos. Un atacante podr\u00eda aprovechar esta vulnerabilidad creando una referencia de archivo espec\u00edfica en el sistema de archivos y luego accediendo a ella a trav\u00e9s de la interfaz de administraci\u00f3n basada en web. Una explotaci\u00f3n exitosa podr\u00eda permitir que el atacante lea archivos arbitrarios del sistema de archivos del sistema operativo subyacente. Cisco ha publicado actualizaciones de software que solucionan esta vulnerabilidad. No existen workarounds que solucionen esta vulnerabilidad."}], "lastModified": "2024-11-18T17:11:56.587", "sourceIdentifier": "ykramarz@cisco.com"}