Lucene search

CiscoCVE-2021-1218

HistoryJan 20, 2021 - 9:15 p.m.

CVE-2021-1218

2021-01-2021:15:11

CWE-601

cisco

web.nvd.nist.gov

cve-2021-1218

cisco

smart software manager

web management

vulnerability

input validation

http request

remote attacker

undesired web page

exploit

malicious url

CVSS2

4.9

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:P/I:P/A:N

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

AI Score

5.4

Confidence

High

EPSS

0.001

Percentile

30.8%

JSON

A vulnerability in the web management interface of Cisco Smart Software Manager satellite could allow an authenticated, remote attacker to redirect a user to an undesired web page. The vulnerability is due to improper input validation of the URL parameters in an HTTP request that is sent to an affected device. An attacker could exploit this vulnerability by sending a crafted HTTP request that could cause the web application to redirect the request to a specified malicious URL. A successful exploit could allow the attacker to redirect a user to a malicious website.

Affected configurations

Nvd

Node

ciscosmart_software_manager_on-premRange≤5.0

VendorProductVersionCPE
ciscosmart_software_manager_on-prem*cpe:2.3:a:cisco:smart_software_manager_on-prem:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
cisco	smart_software_manager_on-prem	*	cpe:2.3:a:cisco:smart_software_manager_on-prem::::::::

CNA Affected

[
  {
    "product": "Cisco Smart Software Manager On-Prem",
    "vendor": "Cisco",
    "versions": [
      {
        "status": "affected",
        "version": "n/a"
      }
    ]
  }
]

References

tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cssmor-MDCWkT2x

CVSS2

4.9

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:P/I:P/A:N

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

AI Score

5.4

Confidence

High

EPSS

0.001

Percentile

30.8%

JSON

Related for CVE-2021-1218