2 lines
4.0 KiB
JSON
2 lines
4.0 KiB
JSON
{"affected":[{"affectedData":[{"product":"Cisco Unified Computing System Central Software","vendor":"Cisco","versions":[{"status":"affected","version":"n/a"}]}],"source":"psirt@cisco.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:cisco:unified_computing_system_central_software:*:*:*:*:*:*:*:*","matchCriteriaId":"F1170ACD-B57A-4522-BC6F-0AAF00746E70","versionEndExcluding":"2.0\\(1m\\)","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability in the certificate registration process of Cisco Unified Computing System (UCS) Central Software could allow an authenticated, adjacent attacker to register a rogue Cisco Unified Computing System Manager (UCSM). This vulnerability is due to improper certificate validation. An attacker could exploit this vulnerability by sending a crafted HTTP request to the registration API. A successful exploit could allow the attacker to register a rogue Cisco UCSM and gain access to Cisco UCS Central Software data and Cisco UCSM inventory data."},{"lang":"es","value":"Una vulnerabilidad en el proceso de registro de certificados del Software Cisco Unified Computing System (UCS) Central, podría permitir a un atacante adyacente autenticado registrar un Cisco Unified Computing System Manager (UCSM) malicioso. Esta vulnerabilidad es debido a una comprobación inapropiada del certificado. Un atacante podría explotar esta vulnerabilidad mediante el envío de una petición HTTP diseñada hacia la API de registro. Una explotación con éxito podría permitir al atacante registrar un Cisco UCSM malicioso y conseguir acceso a los datos del Software Cisco UCS Central y los datos del inventario de Cisco UCSM"}],"id":"CVE-2021-1354","lastModified":"2026-06-17T03:31:34.783","metrics":{"cvssMetricV2":[{"acInsufInfo":false,"baseSeverity":"LOW","cvssData":{"accessComplexity":"LOW","accessVector":"ADJACENT_NETWORK","authentication":"SINGLE","availabilityImpact":"NONE","baseScore":2.7,"confidentialityImpact":"PARTIAL","integrityImpact":"NONE","vectorString":"AV:A/AC:L/Au:S/C:P/I:N/A:N","version":"2.0"},"exploitabilityScore":5.1,"impactScore":2.9,"obtainAllPrivilege":false,"obtainOtherPrivilege":false,"obtainUserPrivilege":false,"source":"nvd@nist.gov","type":"Primary","userInteractionRequired":false}],"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"psirt@cisco.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"NONE","baseScore":3.5,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.1,"impactScore":1.4,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2021-1354","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2024-11-08T20:49:28.998994Z","version":"2.0.3"}}]},"published":"2021-02-04T17:15:18.763","references":[{"source":"psirt@cisco.com","tags":["Vendor Advisory"],"url":"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ucs-invcert-eOpRvCKH"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"url":"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ucs-invcert-eOpRvCKH"}],"sourceIdentifier":"psirt@cisco.com","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-295"}],"source":"psirt@cisco.com","type":"Secondary"}]}
|