Vulnerability · Published Nov 4, 2021 · Assigned by cisco
CVE-2021-34774Cisco Common Services Platform Collector Information Disclosure Vulnerability
Medium 4.9
In plain English
A medium-severity information exposure in Cisco Common Services Platform Collector Software from Cisco. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 63% of all known vulnerabilities).
Official description
A vulnerability in the web-based management interface of Cisco Common Services Platform Collector (CSPC) could allow an authenticated, remote attacker to access sensitive data on an affected system. This vulnerability exists because the application does not sufficiently protect sensitive data when responding to a specific API request. An attacker could exploit the vulnerability by sending a crafted HTTP request to the affected application. A successful exploit could allow the attacker to obtain sensitive information about the users of the application, including security questions and answers. To exploit this vulnerability an attacker would need valid Administrator credentials. Cisco expects to release software updates that address this vulnerability.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Cisco | Cisco Common Services Platform Collector Software | n/a |
Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
References
- 20211103 Cisco Common Services Platform Collector Information Disclosure Vulnerability vendor-advisory, x_refsource_CISCO