2 lines
4.1 KiB
JSON
2 lines
4.1 KiB
JSON
{"affected":[{"affectedData":[{"product":"Cisco Connected Mobile Experiences","vendor":"Cisco","versions":[{"status":"affected","version":"n/a"}]}],"source":"psirt@cisco.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:cisco:connected_mobile_experiences:10.6.0:*:*:*:*:*:*:*","matchCriteriaId":"46B3BCD8-4F1F-4503-9427-1787B7B5B112","vulnerable":true},{"criteria":"cpe:2.3:a:cisco:connected_mobile_experiences:10.6.1:*:*:*:*:*:*:*","matchCriteriaId":"A4548832-9572-4CBF-B77F-1A72ABAF2910","vulnerable":true},{"criteria":"cpe:2.3:a:cisco:connected_mobile_experiences:10.6.2:*:*:*:*:*:*:*","matchCriteriaId":"3B8CAC5F-18EF-446B-9A69-A5AB70EA753A","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability in Cisco Connected Mobile Experiences (CMX) API authorizations could allow an authenticated, remote attacker to enumerate what users exist on the system. The vulnerability is due to a lack of authorization checks for certain API GET requests. An attacker could exploit this vulnerability by sending specific API GET requests to an affected device. A successful exploit could allow the attacker to enumerate users of the CMX system."},{"lang":"es","value":"Una vulnerabilidad en autorizaciones de Cisco Connected Mobile Experiences (CMX) API, podría permitir a un atacante autenticado remoto enumerar qué usuarios existen en el sistema. La vulnerabilidad es debido a una falta de controles de autorización para determinadas peticiones GET de la API. Un atacante podría explotar esta vulnerabilidad mediante el envío de peticiones GET de la API especifica hacia un dispositivo afectado. Una explotación con éxito podría permitir al atacante enumerar a los usuarios del sistema CMX."}],"id":"CVE-2021-1143","lastModified":"2026-06-17T03:31:02.683","metrics":{"cvssMetricV2":[{"acInsufInfo":false,"baseSeverity":"MEDIUM","cvssData":{"accessComplexity":"LOW","accessVector":"NETWORK","authentication":"SINGLE","availabilityImpact":"NONE","baseScore":4.0,"confidentialityImpact":"PARTIAL","integrityImpact":"NONE","vectorString":"AV:N/AC:L/Au:S/C:P/I:N/A:N","version":"2.0"},"exploitabilityScore":8.0,"impactScore":2.9,"obtainAllPrivilege":false,"obtainOtherPrivilege":false,"obtainUserPrivilege":false,"source":"nvd@nist.gov","type":"Primary","userInteractionRequired":false}],"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"psirt@cisco.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2021-1143","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2024-11-08T20:54:28.540445Z","version":"2.0.3"}}]},"published":"2021-01-13T22:15:14.660","references":[{"source":"psirt@cisco.com","tags":["Vendor Advisory"],"url":"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cmxapi-KsKwCmfp"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"url":"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cmxapi-KsKwCmfp"}],"sourceIdentifier":"psirt@cisco.com","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"psirt@cisco.com","type":"Secondary"},{"description":[{"lang":"en","value":"CWE-862"}],"source":"nvd@nist.gov","type":"Primary"}]}
|