CVE-2021-1257

A vulnerability in the web-based management interface of Cisco DNA Center Software could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack to manipulate an authenticated user into executing malicious actions without their awareness or consent. The vulnerability is due to insufficient CSRF protections for the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a web-based management user to follow a specially crafted link. A successful exploit could allow the attacker to perform arbitrary actions on the device with the privileges of the authenticated user. These actions include modifying the device configuration, disconnecting the user's session, and executing Command Runner commands.
Configurations

Configuration 1 (hide)

cpe:2.3:a:cisco:dna_center:*:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
OR cpe:2.3:a:mcafee:agent:*:*:*:*:*:windows:*:*
cpe:2.3:a:mcafee:agent:*:*:*:*:*:linux:*:*
cpe:2.3:a:mcafee:agent:*:*:*:*:*:macos:*:*
OR cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*

History

01 Jul 2022, 12:52

Type Values Removed Values Added
First Time Apple
Mcafee
Linux
Mcafee agent
Apple macos
Microsoft
Microsoft windows
Linux linux Kernel
CPE cpe:2.3:a:mcafee:agent:*:*:*:*:*:macos:*:*
cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*
cpe:2.3:a:mcafee:agent:*:*:*:*:*:linux:*:*
cpe:2.3:a:mcafee:agent:*:*:*:*:*:windows:*:*
References (CONFIRM) https://kc.mcafee.com/corporate/index?page=content&id=SB10382 - (CONFIRM) https://kc.mcafee.com/corporate/index?page=content&id=SB10382 - Third Party Advisory

13 Apr 2022, 08:15

Type Values Removed Values Added
References
  • (CONFIRM) https://kc.mcafee.com/corporate/index?page=content&id=SB10382 -

27 Jan 2021, 16:28

Type Values Removed Values Added
CPE cpe:2.3:a:cisco:dna_center:*:*:*:*:*:*:*:*
References (CISCO) https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-dnac-csrf-dC83cMcV - (CISCO) https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-dnac-csrf-dC83cMcV - Vendor Advisory
CVSS v2 : unknown
v3 : unknown
v2 : 6.8
v3 : 8.8

25 Jan 2021, 15:15

Type Values Removed Values Added
Summary A vulnerability in the web-based management interface of Cisco DNA Center Software could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack to manipulate an authenticated user into executing malicious actions without their awareness or consent. The vulnerability is due to insufficient CSRF protections for the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a web-based management user to follow a specially crafted link. A successful exploit could allow the attacker to perform arbitrary actions on the device with the privileges of the authenticated user. These actions include modifying the device configuration, disconnecting the user's session, and executing Command Runner commands. A vulnerability in the web-based management interface of Cisco DNA Center Software could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack to manipulate an authenticated user into executing malicious actions without their awareness or consent. The vulnerability is due to insufficient CSRF protections for the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a web-based management user to follow a specially crafted link. A successful exploit could allow the attacker to perform arbitrary actions on the device with the privileges of the authenticated user. These actions include modifying the device configuration, disconnecting the user's session, and executing Command Runner commands.
CWE CWE-352

20 Jan 2021, 20:25

Type Values Removed Values Added
New CVE

Information

Published : 2021-01-20 20:15

Updated : 2022-07-01 12:52


NVD link : CVE-2021-1257

Mitre link : CVE-2021-1257


JSON object : View

Products Affected

linux

  • linux_kernel

cisco

  • dna_center

microsoft

  • windows

apple

  • macos

mcafee

  • agent
CWE
CWE-352

Cross-Site Request Forgery (CSRF)