Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
cveCiscoCVE-2021-1388
HistoryFeb 24, 2021 - 8:15 p.m.

CVE-2021-1388

2021-02-2420:15:13
CWE-269
cisco
web.nvd.nist.gov
74
11
cisco
aci
multi-site
orchestrator
api
endpoint
vulnerability
authentication
bypass
nvd
cve-2021-1388

CVSS2

9.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

CVSS3

10

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

AI Score

9.5

Confidence

High

EPSS

0.026

Percentile

90.3%

JSON

A vulnerability in an API endpoint of Cisco ACI Multi-Site Orchestrator (MSO) installed on the Application Services Engine could allow an unauthenticated, remote attacker to bypass authentication on an affected device. The vulnerability is due to improper token validation on a specific API endpoint. An attacker could exploit this vulnerability by sending a crafted request to the affected API. A successful exploit could allow the attacker to receive a token with administrator-level privileges that could be used to authenticate to the API on affected MSO and managed Cisco Application Policy Infrastructure Controller (APIC) devices.

Affected configurations

Nvd
Node
ciscoaci_multi-site_orchestratorRange3.0–3.0\(3m\)
OR
ciscoapplication_policy_infrastructure_controllerMatch3.0\(3i\)
VendorProductVersionCPE
ciscoaci_multi-site_orchestrator*cpe:2.3:a:cisco:aci_multi-site_orchestrator:*:*:*:*:*:*:*:*
ciscoapplication_policy_infrastructure_controller3.0(3i)cpe:2.3:a:cisco:application_policy_infrastructure_controller:3.0\(3i\):*:*:*:*:*:*:*

CNA Affected

[
  {
    "product": "Cisco ACI Multi-Site Orchestrator Software",
    "vendor": "Cisco",
    "versions": [
      {
        "status": "affected",
        "version": "n/a"
      }
    ]
  }
]

Social References

More

Related

cisco 1
nvd 1
nessus 1
cvelist 1
prion 1
threatpost 1
rapid7blog 1
thn 1
cisco
cisco
Cisco ACI Multi-Site Orchestrator Application Services Engine Deployment Authentication Bypass Vulnerability
2021-02-24 16:00:00
nvd
nvd
CVE-2021-1388
2021-02-24 20:15:13
nessus
nessus
Cisco ACI Multi-Site Orchestrator Application Services Engine Deployment Authentication Bypass (cisco-sa-mso-authbyp-bb5GmBQv)
2021-06-28 00:00:00
cvelist
cvelist
CVE-2021-1388 Cisco ACI Multi-Site Orchestrator Application Services Engine Deployment Authentication Bypass Vulnerability
2021-02-24 19:30:59
prion
prion
Authentication flaw
2021-02-24 20:15:00
threatpost
threatpost
Cisco Warns of Critical Auth-Bypass Security Flaw
2021-02-25 14:45:48
rapid7blog
rapid7blog
Multiple Unauthenticated Remote Code Control and Execution Vulnerabilities in Multiple Cisco Products
2021-02-25 15:14:55
thn
thn
Cisco Releases Security Patches for Critical Flaws Affecting its Products
2021-02-26 08:11:00

CVSS2

9.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

CVSS3

10

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

AI Score

9.5

Confidence

High

EPSS

0.026

Percentile

90.3%

JSON
Related for CVE-2021-1388
cisco1nvd1nessus1cvelist1prion1threatpost1rapid7blog1thn1