CVE-2021-40129

published 2021-11-19

CVE-2021-40129: A vulnerability in the configuration dashboard of Cisco Common Services Platform Collector (CSPC) could allow an authenticated, remote attacker to submit a SQL…

medium 4.9 CVSS 3.1

AV N AC L PR H UI N S U C H I N A N

A vulnerability in the configuration dashboard of Cisco Common Services Platform Collector (CSPC) could allow an authenticated, remote attacker to submit a SQL query through the CSPC configuration dashboard. This vulnerability is due to insufficient input validation of uploaded files. An attacker could exploit this vulnerability by uploading a file containing a SQL query to the configuration dashboard. A successful exploit could allow the attacker to read restricted information from the CSPC SQL database.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
cisco	cisco_common_services_platform_collector_software	—	—
cisco	common_services_platform_collector	< 2.9.1.1	2.9.1.1
cisco	common_services_platform_collector	—	—

CWE-89