CVE-2021-1396

CWE-306 — Missing AuthenticationCWE-552 — Files Accessible to External Parties4 documents4 sources
Severity
6.5MEDIUM
EPSS
0.8%
top 25.50%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Cisco Application Services EngineCisco Cisco Application Services Engine SoftwareCisco Application Policy Infrastructure Controller
Timeline
PublishedFeb 24
Latest updateMay 24

Description

Multiple vulnerabilities in Cisco Application Services Engine could allow an unauthenticated, remote attacker to gain privileged access to host-level operations or to learn device-specific information, create diagnostic files, and make limited configuration changes. For more information about these vulnerabilities, see the Details section of this advisory.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages3 packages

▶NVDcisco/application_services_engine1.1 — 1.1\(3e\)

🔴Vulnerability Details

2
GHSA
GHSA-xmmq-jpx2-43px: Multiple vulnerabilities in Cisco Application Services Engine could allow an unauthenticated, remote attacker to gain privileged access to host-level↗2022-05-24
▶
CVEList
Cisco Application Services Engine Unauthorized Access Vulnerabilities↗2021-02-24
▶

📋Vendor Advisories

1
Cisco
Cisco Application Services Engine Unauthorized Access Vulnerabilities↗2021-02-24
▶
CVE-2021-1396 (MEDIUM CVSS 6.5) | Multiple vulnerabilities in Cisco A | cvebase.io