Lucene search

CiscoCVE-2021-34766

HistoryOct 06, 2021 - 8:15 p.m.

CVE-2021-34766

2021-10-0620:15:13

CWE-269

cisco

web.nvd.nist.gov

cve-2021-34766

cisco

ssm on-prem

web ui

vulnerability

authenticated

remote attacker

privileges

records

settings

CVSS2

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

8.5

Confidence

High

EPSS

0.003

Percentile

68.6%

JSON

A vulnerability in the web UI of Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an authenticated, remote attacker to elevate privileges and create, read, update, or delete records and settings in multiple functions. This vulnerability is due to insufficient authorization of the System User and System Operator role capabilities. An attacker could exploit this vulnerability by directly accessing a web resource. A successful exploit could allow the attacker to create, read, update, or delete records and settings in multiple functions without the necessary permissions on the web UI.

Affected configurations

Nvd

Node

ciscosmart_software_manager_on-premRange<8-202108

VendorProductVersionCPE
ciscosmart_software_manager_on-prem*cpe:2.3:a:cisco:smart_software_manager_on-prem:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
cisco	smart_software_manager_on-prem	*	cpe:2.3:a:cisco:smart_software_manager_on-prem::::::::

CNA Affected

[
  {
    "product": "Cisco Smart Software Manager On-Prem",
    "vendor": "Cisco",
    "versions": [
      {
        "status": "affected",
        "version": "n/a"
      }
    ]
  }
]

References

tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ssm-priv-esc-5g35cdDJ

CVSS2

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

8.5

Confidence

High

EPSS

0.003

Percentile

68.6%

JSON

Related for CVE-2021-34766