CVE-2021-1385

Common vulnerabilities & exposures (CVE)

CVE database CVE database blogpost Release & EoL database

Published at: - 24-03-2021 09:15

Last modified: - 12-05-2022 04:35

Total changes: - 4

Description

A vulnerability in the Cisco IOx application hosting environment of multiple Cisco platforms could allow an authenticated, remote attacker to conduct directory traversal attacks and read and write files on the underlying operating system or host system. This vulnerability occurs because the device does not properly validate URIs in IOx API requests. An attacker could exploit this vulnerability by sending a crafted API request that contains directory traversal character sequences to an affected device. A successful exploit could allow the attacker to read or write arbitrary files on the underlying operating system.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

Low

Attack complexity

Network

Attack vector

None

Availability

High

Confidentiality

High

Integrity

High

Privileges required

Unchanged

Scope

None

User interaction

6.5

Base score

1.2

5.2

Exploitability score

Impact score

Verification logic

vendor=cisco AND product=ios_xe AND version=16.12.1

vendor=cisco AND product=ios_xe AND version=16.11.1

vendor=cisco AND product=ios_xe AND version=17.1.1

vendor=cisco AND product=ios_xe AND version=16.11.1a

vendor=cisco AND product=ios_xe AND version=16.12.1c

vendor=cisco AND product=ios_xe AND version=16.12.1t

vendor=cisco AND product=ios_xe AND version=16.11.2

vendor=cisco AND product=ios_xe AND version=16.12.1s

vendor=cisco AND product=ios_xe AND version=16.12.1a

vendor=cisco AND product=ios_xe AND version=16.12.1x

vendor=cisco AND product=ios AND version=15.8\(3\)m2a

vendor=cisco AND product=ios AND version=15.8\(3\)m3

vendor=cisco AND product=ios AND version=15.8\(3\)m4

vendor=cisco AND product=ios AND version=15.8\(3\)m5

vendor=cisco AND product=ios AND version=15.9\(3\)m

vendor=cisco AND product=ios_xe AND version=16.11.1b

vendor=cisco AND product=ios_xe AND version=16.11.1c

vendor=cisco AND product=ios_xe AND version=16.11.1s

vendor=cisco AND product=ios_xe AND version=16.12.1w

vendor=cisco AND product=ios_xe AND version=16.12.1y

vendor=cisco AND product=ios_xe AND version=16.12.2

vendor=cisco AND product=ios_xe AND version=16.12.2a

vendor=cisco AND product=ios_xe AND version=16.12.2s

vendor=cisco AND product=ios_xe AND version=16.12.2t

vendor=cisco AND product=ios_xe AND version=16.12.3

vendor=cisco AND product=ios_xe AND version=16.12.4

vendor=cisco AND product=ios_xe AND version=17.1.1a

vendor=cisco AND product=ios_xe AND version=17.1.1s

vendor=cisco AND product=ios_xe AND version=17.2.1

vendor=cisco AND product=ios_xe AND version=17.4.1

vendor=cisco AND product=ios AND version=15.8\(3\)m6

vendor=cisco AND product=ios AND version=15.9\(3\)m1

vendor=cisco AND product=ios AND version=15.9\(3\)m2

vendor=cisco AND product=ios AND version=15.9\(3\)m2a

vendor=cisco AND product=ios AND version=15.9\(3\)m3

vendor=cisco AND product=ios_xe AND version=16.12.1z

vendor=cisco AND product=ios_xe AND version=16.12.1z1

vendor=cisco AND product=ios_xe AND version=16.12.1za

vendor=cisco AND product=ios_xe AND version=16.12.3a

vendor=cisco AND product=ios_xe AND version=16.12.3s

vendor=cisco AND product=ios_xe AND version=16.12.4a

vendor=cisco AND product=ios_xe AND version=16.12.5

vendor=cisco AND product=ios_xe AND version=17.1.1t

vendor=cisco AND product=ios_xe AND version=17.1.2

vendor=cisco AND product=ios_xe AND version=17.1.3

vendor=cisco AND product=ios_xe AND version=17.2.1a

vendor=cisco AND product=ios_xe AND version=17.2.1r

vendor=cisco AND product=ios_xe AND version=17.2.1v

vendor=cisco AND product=ios_xe AND version=17.2.2

vendor=cisco AND product=ios_xe AND version=17.3.1

vendor=cisco AND product=ios_xe AND version=17.3.1a

vendor=cisco AND product=ios_xe AND version=17.3.1w

vendor=cisco AND product=ios_xe AND version=17.3.1x

vendor=cisco AND product=ios_xe AND version=17.3.2

vendor=cisco AND product=ios_xe AND version=17.3.2a

vendor=cisco AND product=ios_xe AND version=17.4.1a

vendor=cisco AND product=ios_xe AND version=17.4.1b

Reference

Keywords

CVE-2021-1385

Common vulnerabilities & exposures (CVE)

Description

Common Vulnerability Scoring System (CVSS)

Verification logic

Reference

NVD

CVE-2021-1385

CVE

Common vulnerabilities & exposures

CVSS

Common vulnerability scoring system

Security

Vulnerabilities

Exposures