CVE-2021-40129

CWE-89 — SQL Injection4 documents4 sources
Severity
4.9MEDIUM
EPSS
0.3%
top 51.51%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Cisco Common Services Platform CollectorCisco Cisco Common Services Platform Collector Software
Timeline
PublishedNov 19
Latest updateMay 24

Description

A vulnerability in the configuration dashboard of Cisco Common Services Platform Collector (CSPC) could allow an authenticated, remote attacker to submit a SQL query through the CSPC configuration dashboard. This vulnerability is due to insufficient input validation of uploaded files. An attacker could exploit this vulnerability by uploading a file containing a SQL query to the configuration dashboard. A successful exploit could allow the attacker to read restricted information from the CSPC SQL…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:NExploitability: 1.2 | Impact: 3.6

Affected Packages2 packages

🔴Vulnerability Details

2
GHSA
GHSA-rj68-45gv-f3rv: A vulnerability in the configuration dashboard of Cisco Common Services Platform Collector (CSPC) could allow an authenticated, remote attacker to sub↗2022-05-24
▶
CVEList
Cisco Common Services Platform Collector SQL Injection Vulnerability↗2021-11-18
▶

📋Vendor Advisories

1
Cisco
Cisco Common Services Platform Collector SQL Injection Vulnerability↗2021-11-17
▶
CVE-2021-40129 (MEDIUM CVSS 4.9) | A vulnerability in the configuratio | cvebase.io