CVE-2021-1284 — Improper Access Control in Cisco Catalyst Sd-wan Manager

CWE-284 — Improper Access ControlCWE-1284 — Improper Validation of Specified Quantity in InputCWE-20 — Improper Input Validation13 documents7 sources
Severity
8.8HIGHNVD
GHSA2.5
EPSS
0.1%
top 77.51%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Cisco Catalyst Sd-wan ManagerCisco Sd-wan VmanageCisco Sd-wan Vmanage
Timeline
PublishedMay 6
Latest updateMay 24

Description

A vulnerability in the web-based messaging service interface of Cisco SD-WAN vManage Software could allow an unauthenticated, adjacent attacker to bypass authentication and authorization and modify the configuration of an affected system. To exploit this vulnerability, the attacker must be able to access an associated Cisco SD-WAN vEdge device. This vulnerability is due to insufficient authorization checks. An attacker could exploit this vulnerability by sending crafted HTTP requests to the web-…

CVSS vector

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages3 packages

▶NVDcisco/sd-wan_vmanage< 20.3.1
▶NVDcisco/catalyst_sd-wan_manager20.4 — 20.4.1+1

🔴Vulnerability Details

5
GHSA
GHSA-5frf-w38r-8j6h: A vulnerability in the web-based messaging service interface of Cisco SD-WAN vManage Software could allow an unauthenticated, adjacent attacker to byp↗2022-05-24
▶
GHSA
Transaction validity oversight in pallet-ethereum↗2021-09-01
▶
GHSA
Missing validation in shape inference for `Dequantize`↗2021-08-25
▶
GHSA
Incomplete validation in `MaxPoolGrad`↗2021-08-25
▶
CVEList
Cisco SD-WAN vManage Software Authentication Bypass Vulnerability↗2021-05-06
▶

📋Vendor Advisories

7
Microsoft
An issue was discovered in net/tipc/crypto.c in the Linux kernel before 5.14.16. The Transparent Inter-Process Communication (TIPC) functionality allows remote attackers to exploit insufficient valida↗2021-11-09
▶
Red Hat
kernel: powerpc: KVM guest OS users can cause host OS memory corruption↗2021-07-23
▶
Red Hat
kernel: data corruption or loss can be triggered by an untrusted device that supplies a buf->len value exceeding the buffer size in drivers/char/virtio_console.c↗2021-07-03
▶
Cisco
Cisco SD-WAN vManage Software Authentication Bypass Vulnerability↗2021-05-05
▶
Red Hat
python-pillow: Excessive memory allocation in ICO image reader↗2021-03-03
▶
CVE-2021-1284 — Improper Access Control in Cisco | cvebase