CVE-2021-34762
Published on: 10/27/2021 12:00:00 AM UTC
Last Modified on: 11/03/2021 07:55:00 PM UTC
CVE-2021-34762 - advisory for cisco-sa-fmc-dir-traversal-95UyW5tk
Source: Mitre Source: NIST CVE.ORG Print: PDF
Certain versions of Firepower Management Center Virtual Appliance from Cisco contain the following vulnerability:
A vulnerability in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to perform a directory traversal attack on an affected device. The attacker would require valid device credentials. The vulnerability is due to insufficient input validation of the HTTPS URL by the web-based management interface. An attacker could exploit this vulnerability by sending a crafted HTTPS request that contains directory traversal character sequences to an affected device. A successful exploit could allow the attacker to read or write arbitrary files on the device.
- CVE-2021-34762 has been assigned by
[email protected] to track the vulnerability - currently rated as HIGH severity. - The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory.
- Affected Vendor/Software: Cisco - Cisco Firepower Management Center version n/a
CVSS3 Score: 8.1 - HIGH
| Attack Vector ⓘ |
Attack Complexity |
Privileges Required |
User Interaction |
|---|---|---|---|
| NETWORK | LOW | LOW | NONE |
| Scope | Confidentiality Impact |
Integrity Impact |
Availability Impact |
| UNCHANGED | HIGH | HIGH | NONE |
CVSS2 Score: 5.5 - MEDIUM
| Access Vector ⓘ |
Access Complexity |
Authentication |
|---|---|---|
| NETWORK | LOW | SINGLE |
| Confidentiality Impact |
Integrity Impact |
Availability Impact |
| PARTIAL | PARTIAL | NONE |
CVE References
| Description | Tags ⓘ | Link |
|---|---|---|
| Cisco Firepower Management Center Software Authenticated Directory Traversal Vulnerability | tools.cisco.com text/html |
CISCO 20211027 Cisco Firepower Management Center Software Authenticated Directory Traversal Vulnerability |
Known Affected Configurations (CPE V2.3)
- cpe:2.3:a:cisco:firepower_management_center_virtual_appliance:6.2.3:*:*:*:*:*:*:*:
- cpe:2.3:a:cisco:firepower_management_center_virtual_appliance:6.4.0:*:*:*:*:*:*:*:
- cpe:2.3:a:cisco:firepower_management_center_virtual_appliance:6.5.0:*:*:*:*:*:*:*:
- cpe:2.3:a:cisco:firepower_management_center_virtual_appliance:6.6.1:*:*:*:*:*:*:*:
- cpe:2.3:a:cisco:firepower_management_center_virtual_appliance:6.6.2:*:*:*:*:*:*:*:
- cpe:2.3:a:cisco:firepower_management_center_virtual_appliance:6.6.3:*:*:*:*:*:*:*:
- cpe:2.3:a:cisco:firepower_management_center_virtual_appliance:6.6.4:*:*:*:*:*:*:*:
- cpe:2.3:a:cisco:firepower_management_center_virtual_appliance:6.7.0:*:*:*:*:*:*:*:
- cpe:2.3:a:cisco:firepower_management_center_virtual_appliance:7.0.0:*:*:*:*:*:*:*:
- cpe:2.3:a:cisco:firepower_management_center_virtual_appliance:7.1.0:*:*:*:*:*:*:*:
- cpe:2.3:a:cisco:firepower_threat_defense:*:*:*:*:*:*:*:*:
- cpe:2.3:a:cisco:sourcefire_defense_center:6.2.3:*:*:*:*:*:*:*:
- cpe:2.3:a:cisco:sourcefire_defense_center:6.4.0:*:*:*:*:*:*:*:
- cpe:2.3:a:cisco:sourcefire_defense_center:6.5.0:*:*:*:*:*:*:*:
- cpe:2.3:a:cisco:sourcefire_defense_center:6.6.1:*:*:*:*:*:*:*:
- cpe:2.3:a:cisco:sourcefire_defense_center:6.6.2:*:*:*:*:*:*:*:
- cpe:2.3:a:cisco:sourcefire_defense_center:6.6.3:*:*:*:*:*:*:*:
- cpe:2.3:a:cisco:sourcefire_defense_center:6.6.4:*:*:*:*:*:*:*:
- cpe:2.3:a:cisco:sourcefire_defense_center:7.0.0:*:*:*:*:*:*:*:
Social Mentions
| Source | Title | Posted (UTC) |
|---|---|---|
 @CVEreport |
CVE-2021-34762 : A vulnerability in the web-based management interface of Cisco Firepower Management Center FM… twitter.com/i/web/status/1… | 2021-10-27 19:07:27 |
| @GrupoICA_Ciber |
?CISCO? Múltiples vulnerabilidades de severidad alta en productos CISCO: CVE-2021-34762,CVE-2021-34756,CVE-2021-3… twitter.com/i/web/status/1… | 2021-10-29 08:07:09 |