Zero-friction vulnerability management platform

Mageni eases for you the vulnerability scanning, assessment, and management process. It is free and open-source.

Install Now

Available for macOS, Windows, and Linux

App screenshot

CVE-2021-1306

CVE information

Published

1 year ago

Last Modified

1 year ago

CVSSv2.0 Severity

Low

CVSSv3.1 Severity

Low

Impact Analysis

Description

A vulnerability in the restricted shell of Cisco Evolved Programmable Network (EPN) Manager, Cisco Identity Services Engine (ISE), and Cisco Prime Infrastructure could allow an authenticated, local attacker to identify directories and write arbitrary files to the file system. This vulnerability is due to improper validation of parameters that are sent to a CLI command within the restricted shell. An attacker could exploit this vulnerability by logging in to the device and issuing certain CLI commands. A successful exploit could allow the attacker to identify file directories on the affected device and write arbitrary files to the file system on the affected device. To exploit this vulnerability, the attacker must be an authenticated shell user..

CVSSv2.0 Score

Severity
Low
Base Score
3.6/10
Exploit Score
3.9/10
Access Vector
Local
Access Complexity
Low
Authentication Required
None
Impact Score
4.9/10
Confidentiality Impact
Partial
Availability Impact
None
Integrity Impact
Partial

CVSSv3.1 Score

Severity
Low
Base Score
3.4/10
Exploit Score
0.8/10
Access Vector
Local
Access Complexity
Low
Privileges Required
High
Impact Score
2.5/10
Confidentiality Impact
Low
Availability Impact
None
Integrity Impact
Low
Scope
Unchanged
User Interaction
None

Products Affected

CPE Affected Vulnerable Excluding Edit
cpe:2.3:a:cisco:identity_services_engine:2.7.0:patch2:*:*:*:
  Yes
- -
cpe:2.3:a:cisco:identity_services_engine:3.0.0:-:*:*:*:*:*:*
  Yes
- -
cpe:2.3:a:cisco:identity_services_engine:3.0.0:patch1:*:*:*:
  Yes
- -
cpe:2.3:a:cisco:identity_services_engine:2.7.0:-:*:*:*:*:*:*
  Yes
- -
cpe:2.3:a:cisco:identity_services_engine:*:*:*:*:*:*:*:*
  Yes
- 2.7.0
cpe:2.3:a:cisco:evolved_programmable_network_manager:*:*:*:*
  Yes
- 5.0.1
cpe:2.3:a:cisco:prime_infrastructure:3.8.1:-:*:*:*:*:*:*
  Yes
- -
cpe:2.3:a:cisco:prime_infrastructure:*:*:*:*:*:*:*:*
  Yes
- 3.8.1