Lucene search

[email protected]NVD:CVE-2021-1436

HistoryMar 24, 2021 - 8:15 p.m.

CVE-2021-1436

2021-03-2420:15:14

CWE-22

[email protected]

web.nvd.nist.gov

cisco ios xe

sd-wan software

path traversal

read access

vulnerability

CVSS2

4.7

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:M/Au:N/C:C/I:N/A:N

CVSS3

4.4

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

EPSS

Percentile

9.9%

JSON

A vulnerability in the CLI of Cisco IOS XE SD-WAN Software could allow an authenticated, local attacker to conduct path traversal attacks and obtain read access to sensitive files on an affected system. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted request to an affected system. A successful exploit could allow the attacker to view arbitrary files on the affected system.

Affected configurations

Nvd

Node

ciscoios_xeMatch3.15.1xbs

ciscoios_xeMatch3.15.2xbs

ciscoios_xeMatch16.11.1

ciscoios_xeMatch16.11.1a

ciscoios_xeMatch16.11.1b

ciscoios_xeMatch16.11.1c

ciscoios_xeMatch16.11.1s

ciscoios_xeMatch16.11.2

ciscoios_xeMatch16.12.1

ciscoios_xeMatch16.12.1a

ciscoios_xeMatch16.12.1c

ciscoios_xeMatch16.12.1s

ciscoios_xeMatch16.12.1t

ciscoios_xeMatch16.12.1w

ciscoios_xeMatch16.12.1x

ciscoios_xeMatch16.12.1y

ciscoios_xeMatch16.12.1z

ciscoios_xeMatch16.12.1za

ciscoios_xeMatch16.12.2

ciscoios_xeMatch16.12.2a

ciscoios_xeMatch16.12.2s

ciscoios_xeMatch16.12.2t

ciscoios_xeMatch16.12.3

ciscoios_xeMatch16.12.3a

ciscoios_xeMatch16.12.3s

ciscoios_xeMatch16.12.4

ciscoios_xeMatch16.12.4a

ciscoios_xeMatch17.1.1

ciscoios_xeMatch17.1.1a

ciscoios_xeMatch17.1.1s

ciscoios_xeMatch17.1.1t

ciscoios_xeMatch17.1.2

ciscoios_xeMatch17.2.1

ciscoios_xeMatch17.2.1a

ciscoios_xeMatch17.2.1r

ciscoios_xeMatch17.2.1v

ciscoios_xeMatch17.2.2

VendorProductVersionCPE
ciscoios_xe3.15.1xbscpe:2.3:o:cisco:ios_xe:3.15.1xbs:*:*:*:*:*:*:*
ciscoios_xe3.15.2xbscpe:2.3:o:cisco:ios_xe:3.15.2xbs:*:*:*:*:*:*:*
ciscoios_xe16.11.1cpe:2.3:o:cisco:ios_xe:16.11.1:*:*:*:*:*:*:*
ciscoios_xe16.11.1acpe:2.3:o:cisco:ios_xe:16.11.1a:*:*:*:*:*:*:*
ciscoios_xe16.11.1bcpe:2.3:o:cisco:ios_xe:16.11.1b:*:*:*:*:*:*:*
ciscoios_xe16.11.1ccpe:2.3:o:cisco:ios_xe:16.11.1c:*:*:*:*:*:*:*
ciscoios_xe16.11.1scpe:2.3:o:cisco:ios_xe:16.11.1s:*:*:*:*:*:*:*
ciscoios_xe16.11.2cpe:2.3:o:cisco:ios_xe:16.11.2:*:*:*:*:*:*:*
ciscoios_xe16.12.1cpe:2.3:o:cisco:ios_xe:16.12.1:*:*:*:*:*:*:*
ciscoios_xe16.12.1acpe:2.3:o:cisco:ios_xe:16.12.1a:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
cisco	ios_xe	3.15.1xbs	cpe:2.3:o:cisco:ios_xe:3.15.1xbs:::::::*
cisco	ios_xe	3.15.2xbs	cpe:2.3:o:cisco:ios_xe:3.15.2xbs:::::::*
cisco	ios_xe	16.11.1	cpe:2.3:o:cisco:ios_xe:16.11.1:::::::*
cisco	ios_xe	16.11.1a	cpe:2.3:o:cisco:ios_xe:16.11.1a:::::::*
cisco	ios_xe	16.11.1b	cpe:2.3:o:cisco:ios_xe:16.11.1b:::::::*
cisco	ios_xe	16.11.1c	cpe:2.3:o:cisco:ios_xe:16.11.1c:::::::*
cisco	ios_xe	16.11.1s	cpe:2.3:o:cisco:ios_xe:16.11.1s:::::::*
cisco	ios_xe	16.11.2	cpe:2.3:o:cisco:ios_xe:16.11.2:::::::*
cisco	ios_xe	16.12.1	cpe:2.3:o:cisco:ios_xe:16.12.1:::::::*
cisco	ios_xe	16.12.1a	cpe:2.3:o:cisco:ios_xe:16.12.1a:::::::*

Rows per page:

1-10 of 371

References

tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-sdwpathtrav-nsrue2Mt

CVSS2

4.7

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:M/Au:N/C:C/I:N/A:N

CVSS3

4.4

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

EPSS

Percentile

9.9%

JSON

Related for NVD:CVE-2021-1436

cve1 cvelist1 cisco1 prion1