CVE-2021-1499

Cisco HyperFlex HX Data Platform File Upload Vulnerability

Severity Score

5.3

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

Attend

*SSVC

Descriptions

A vulnerability in the web-based management interface of Cisco HyperFlex HX Data Platform could allow an unauthenticated, remote attacker to upload files to an affected device. This vulnerability is due to missing authentication for the upload function. An attacker could exploit this vulnerability by sending a specific HTTP request to an affected device. A successful exploit could allow the attacker to upload files to the affected device with the permissions of the tomcat8 user.

Una vulnerabilidad en la interfaz de administración basada en web de Cisco HyperFlex HX Data Platform, podría permitir a un atacante remoto no autenticado cargar archivos en un dispositivo afectado. Esta vulnerabilidad es debido a una falta de autenticación para la función upload. Un atacante podría explotar esta vulnerabilidad mediante el envío una petición HTTP específica hacia un dispositivo afectado. Una explotación con éxito podría permitir al atacante cargar archivos al dispositivo afectado con los permisos del usuario tomcat8

*Credits: N/A

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Attack Vector

Network

Attack Complexity

Low

Authentication

None

Confidentiality

None

Integrity

Partial

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:Attend

Exploitation

None

Automatable

Yes

Tech. Impact

Partial

* Organization's Worst-case Scenario

Timeline

2020-11-13 CVE Reserved
2021-05-06 CVE Published
2024-05-08 EPSS Updated
2024-11-08 CVE Updated
2024-11-08 First Exploit
---------- Exploited in Wild
---------- KEV Due Date

CWE

CWE-306: Missing Authentication for Critical Function

CAPEC

References (3)

URL	Tag	Source
https://attackerkb.com/assessments/82738621-1114-4aba-990a-9ea007b05834

URL	Date	SRC
http://packetstormsecurity.com/files/163203/Cisco-HyperFlex-HX-Data-Platform-File-Upload-Remote-Code-Execution.html	2024-11-08

URL	Date	SRC

URL	Date	SRC
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hyperflex-upload-KtCK8Ugz	2023-11-07

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Cisco Search vendor "Cisco"	Hyperflex Hx Data Platform Search vendor "Cisco" for product "Hyperflex Hx Data Platform"	< 4.0\(2e\) Search vendor "Cisco" for product "Hyperflex Hx Data Platform" and version " < 4.0\(2e\)"	-	Affected	in	Cisco Search vendor "Cisco"	Hyperflex Hx220c Af M5 Search vendor "Cisco" for product "Hyperflex Hx220c Af M5"	-	-	Safe
Cisco Search vendor "Cisco"	Hyperflex Hx Data Platform Search vendor "Cisco" for product "Hyperflex Hx Data Platform"	< 4.0\(2e\) Search vendor "Cisco" for product "Hyperflex Hx Data Platform" and version " < 4.0\(2e\)"	-	Affected	in	Cisco Search vendor "Cisco"	Hyperflex Hx220c All Nvme M5 Search vendor "Cisco" for product "Hyperflex Hx220c All Nvme M5"	-	-	Safe
Cisco Search vendor "Cisco"	Hyperflex Hx Data Platform Search vendor "Cisco" for product "Hyperflex Hx Data Platform"	< 4.0\(2e\) Search vendor "Cisco" for product "Hyperflex Hx Data Platform" and version " < 4.0\(2e\)"	-	Affected	in	Cisco Search vendor "Cisco"	Hyperflex Hx220c Edge M5 Search vendor "Cisco" for product "Hyperflex Hx220c Edge M5"	-	-	Safe
Cisco Search vendor "Cisco"	Hyperflex Hx Data Platform Search vendor "Cisco" for product "Hyperflex Hx Data Platform"	< 4.0\(2e\) Search vendor "Cisco" for product "Hyperflex Hx Data Platform" and version " < 4.0\(2e\)"	-	Affected	in	Cisco Search vendor "Cisco"	Hyperflex Hx220c M5 Search vendor "Cisco" for product "Hyperflex Hx220c M5"	-	-	Safe
Cisco Search vendor "Cisco"	Hyperflex Hx Data Platform Search vendor "Cisco" for product "Hyperflex Hx Data Platform"	< 4.0\(2e\) Search vendor "Cisco" for product "Hyperflex Hx Data Platform" and version " < 4.0\(2e\)"	-	Affected	in	Cisco Search vendor "Cisco"	Hyperflex Hx240c Search vendor "Cisco" for product "Hyperflex Hx240c"	-	-	Safe
Cisco Search vendor "Cisco"	Hyperflex Hx Data Platform Search vendor "Cisco" for product "Hyperflex Hx Data Platform"	< 4.0\(2e\) Search vendor "Cisco" for product "Hyperflex Hx Data Platform" and version " < 4.0\(2e\)"	-	Affected	in	Cisco Search vendor "Cisco"	Hyperflex Hx240c Af M5 Search vendor "Cisco" for product "Hyperflex Hx240c Af M5"	-	-	Safe
Cisco Search vendor "Cisco"	Hyperflex Hx Data Platform Search vendor "Cisco" for product "Hyperflex Hx Data Platform"	< 4.0\(2e\) Search vendor "Cisco" for product "Hyperflex Hx Data Platform" and version " < 4.0\(2e\)"	-	Affected	in	Cisco Search vendor "Cisco"	Hyperflex Hx240c M5 Search vendor "Cisco" for product "Hyperflex Hx240c M5"	-	-	Safe
Cisco Search vendor "Cisco"	Hyperflex Hx Data Platform Search vendor "Cisco" for product "Hyperflex Hx Data Platform"	>= 4.5 < 4.5\(2a\) Search vendor "Cisco" for product "Hyperflex Hx Data Platform" and version " >= 4.5 < 4.5\(2a\)"	-	Affected	in	Cisco Search vendor "Cisco"	Hyperflex Hx220c Af M5 Search vendor "Cisco" for product "Hyperflex Hx220c Af M5"	-	-	Safe
Cisco Search vendor "Cisco"	Hyperflex Hx Data Platform Search vendor "Cisco" for product "Hyperflex Hx Data Platform"	>= 4.5 < 4.5\(2a\) Search vendor "Cisco" for product "Hyperflex Hx Data Platform" and version " >= 4.5 < 4.5\(2a\)"	-	Affected	in	Cisco Search vendor "Cisco"	Hyperflex Hx220c All Nvme M5 Search vendor "Cisco" for product "Hyperflex Hx220c All Nvme M5"	-	-	Safe
Cisco Search vendor "Cisco"	Hyperflex Hx Data Platform Search vendor "Cisco" for product "Hyperflex Hx Data Platform"	>= 4.5 < 4.5\(2a\) Search vendor "Cisco" for product "Hyperflex Hx Data Platform" and version " >= 4.5 < 4.5\(2a\)"	-	Affected	in	Cisco Search vendor "Cisco"	Hyperflex Hx220c Edge M5 Search vendor "Cisco" for product "Hyperflex Hx220c Edge M5"	-	-	Safe
Cisco Search vendor "Cisco"	Hyperflex Hx Data Platform Search vendor "Cisco" for product "Hyperflex Hx Data Platform"	>= 4.5 < 4.5\(2a\) Search vendor "Cisco" for product "Hyperflex Hx Data Platform" and version " >= 4.5 < 4.5\(2a\)"	-	Affected	in	Cisco Search vendor "Cisco"	Hyperflex Hx220c M5 Search vendor "Cisco" for product "Hyperflex Hx220c M5"	-	-	Safe
Cisco Search vendor "Cisco"	Hyperflex Hx Data Platform Search vendor "Cisco" for product "Hyperflex Hx Data Platform"	>= 4.5 < 4.5\(2a\) Search vendor "Cisco" for product "Hyperflex Hx Data Platform" and version " >= 4.5 < 4.5\(2a\)"	-	Affected	in	Cisco Search vendor "Cisco"	Hyperflex Hx240c Search vendor "Cisco" for product "Hyperflex Hx240c"	-	-	Safe
Cisco Search vendor "Cisco"	Hyperflex Hx Data Platform Search vendor "Cisco" for product "Hyperflex Hx Data Platform"	>= 4.5 < 4.5\(2a\) Search vendor "Cisco" for product "Hyperflex Hx Data Platform" and version " >= 4.5 < 4.5\(2a\)"	-	Affected	in	Cisco Search vendor "Cisco"	Hyperflex Hx240c Af M5 Search vendor "Cisco" for product "Hyperflex Hx240c Af M5"	-	-	Safe
Cisco Search vendor "Cisco"	Hyperflex Hx Data Platform Search vendor "Cisco" for product "Hyperflex Hx Data Platform"	>= 4.5 < 4.5\(2a\) Search vendor "Cisco" for product "Hyperflex Hx Data Platform" and version " >= 4.5 < 4.5\(2a\)"	-	Affected	in	Cisco Search vendor "Cisco"	Hyperflex Hx240c M5 Search vendor "Cisco" for product "Hyperflex Hx240c M5"	-	-	Safe