CVE-2021-1129
Cisco Email Security Appliance, Cisco Content Security Management Appliance, and Cisco Web Security Appliance Information Disclosure Vulnerability
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
A vulnerability in the authentication for the general purpose APIs implementation of Cisco Email Security Appliance (ESA), Cisco Content Security Management Appliance (SMA), and Cisco Web Security Appliance (WSA) could allow an unauthenticated, remote attacker to access general system information and certain configuration information from an affected device. The vulnerability exists because a secure authentication token is not required when authenticating to the general purpose API. An attacker could exploit this vulnerability by sending a crafted request for information to the general purpose API on an affected device. A successful exploit could allow the attacker to obtain system and configuration information from the affected device, resulting in an unauthorized information disclosure.
Una vulnerabilidad en la autenticación para la implementación de las API de propósito general de Cisco Email Security Appliance (ESA), Cisco Content Security Management Appliance (SMA) y Cisco Web Security Appliance (WSA), podría permitir a un atacante no autenticado remoto acceder a información general del sistema y determinada información de configuración de un dispositivo afectado. La vulnerabilidad se presenta porque no se requiere un token de autenticación seguro al autenticarse en la API de propósito general. Un atacante podría explotar esta vulnerabilidad mediante el envío de una petición diseñada para información de la API de propósito general en un dispositivo afectado. Una explotación con éxito podría permitir al atacante obtener información del sistema y la configuración del dispositivo afectado, resultando en una divulgación de información no autorizada
CVSS Scores
SSVC
- Decision:-
Timeline
- 2020-11-13 CVE Reserved
- 2021-01-20 CVE Published
- 2024-01-24 EPSS Updated
- 2024-09-16 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-201: Insertion of Sensitive Information Into Sent Data
CAPEC
References (1)
URL | Tag | Source |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Cisco Search vendor "Cisco" | Content Security Management Appliance Search vendor "Cisco" for product "Content Security Management Appliance" | 12.5.0 Search vendor "Cisco" for product "Content Security Management Appliance" and version "12.5.0" | - |
Affected
| ||||||
Cisco Search vendor "Cisco" | Email Security Appliance Search vendor "Cisco" for product "Email Security Appliance" | 13.0.0 Search vendor "Cisco" for product "Email Security Appliance" and version "13.0.0" | - |
Affected
| ||||||
Cisco Search vendor "Cisco" | Web Security Appliance Search vendor "Cisco" for product "Web Security Appliance" | 11.8.0 Search vendor "Cisco" for product "Web Security Appliance" and version "11.8.0" | - |
Affected
|