Vulnerability · Published May 6, 2021 · Assigned by cisco
CVE-2021-1499Cisco HyperFlex HX Data Platform File Upload Vulnerability
Medium 5.3
In plain English
A medium-severity missing authentication in Cisco HyperFlex HX Data Platform from Cisco. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 80.0% (higher than 99.6% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, Nuclei.
Official description
A vulnerability in the web-based management interface of Cisco HyperFlex HX Data Platform could allow an unauthenticated, remote attacker to upload files to an affected device. This vulnerability is due to missing authentication for the upload function. An attacker could exploit this vulnerability by sending a specific HTTP request to an affected device. A successful exploit could allow the attacker to upload files to the affected device with the permissions of the tomcat8 user.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Cisco | Cisco HyperFlex HX Data Platform | n/a |
Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
References
- 20210505 Cisco HyperFlex HX Data Platform File Upload Vulnerability vendor-advisory, x_refsource_CISCO
- http://packetstormsecurity.com/files/163203/Cisco-HyperFlex-HX-Data-Platform-File-Upload-Remote-Code-Execution.html x_refsource_MISC