Vulnerability · Published Jan 20, 2021 · Assigned by cisco
CVE-2021-1272Cisco Data Center Network Manager Server-Side Request Forgery Vulnerability
High 8.8
In plain English
A high-severity server-side request forgery in Cisco Data Center Network Manager from Cisco. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 71% of all known vulnerabilities).
Official description
A vulnerability in the session validation feature of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to bypass access controls and conduct a server-side request forgery (SSRF) attack on a targeted system. This vulnerability is due to insufficient validation of parameters in a specific HTTP request by an attacker. An attacker could exploit this vulnerability by sending a crafted HTTP request to an authenticated user of the DCNM web application. A successful exploit could allow the attacker to bypass access controls and gain unauthorized access to the Device Manager application, which provides access to network devices managed by the system.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Cisco | Cisco Data Center Network Manager | n/a |
Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- 20210120 Cisco Data Center Network Manager Server-Side Request Forgery Vulnerability vendor-advisory, x_refsource_CISCO