CVE-2021-34712 : A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, rem

A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to conduct cypher query language injection attacks on an affected system. This vulnerability is due to insufficient input validation by the web-based management interface. An attacker could exploit this vulnerability by sending crafted HTTP requests to the interface of an affected system. A successful exploit could allow the attacker to obtain sensitive information.

Published 2021-09-23 03:15:18

Updated 2023-10-16 16:35:25

Source Cisco Systems, Inc.

View at NVD, CVE.org

Exploit prediction scoring system (EPSS) score for CVE-2021-34712

EPSS FAQ

0.08%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 32 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2021-34712

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
4.0	MEDIUM	AV:N/AC:L/Au:S/C:P/I:N/A:N	8.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: Single Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None
5.4	MEDIUM	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N	2.8	2.5	Cisco Systems, Inc.
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: Low Integrity: Low Availability: None
6.5	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N	2.8	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None

CWE ids for CVE-2021-34712

CWE-943 Improper Neutralization of Special Elements in Data Query Logic

The product generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query.

Assigned by: ykramarz@cisco.com (Secondary)

Products affected by CVE-2021-34712

Cisco » Sd-wan Vmanage
Versions from including (>=) 20.3 and before (<) 20.3.4
cpe:2.3:a:cisco:sd-wan_vmanage:*:*:*:*:*:*:*:*
Matching versions
Cisco » Catalyst Sd-wan Manager
Versions from including (>=) 20.4 and up to, including, (<=) 20.4.2
cpe:2.3:a:cisco:catalyst_sd-wan_manager:*:*:*:*:*:*:*:*
Matching versions
Cisco » Catalyst Sd-wan Manager » Version: 20.5
cpe:2.3:a:cisco:catalyst_sd-wan_manager:20.5:*:*:*:*:*:*:*
Matching versions
Cisco » Catalyst Sd-wan Manager » Version: 20.6
cpe:2.3:a:cisco:catalyst_sd-wan_manager:20.6:*:*:*:*:*:*:*
Matching versions

Vulnerability Details : CVE-2021-34712

Exploit prediction scoring system (EPSS) score for CVE-2021-34712

CVSS scores for CVE-2021-34712

CWE ids for CVE-2021-34712

References for CVE-2021-34712

Products affected by CVE-2021-34712