A vulnerability in the web-based management interface of Cisco HyperFlex HX Data Platform could allow an unauthenticated, remote attacker to upload files to an affected device. This vulnerability is due to missing authentication for the upload function. An attacker could exploit this vulnerability by sending a specific HTTP request to an affected device. A successful exploit could allow the attacker to upload files to the affected device with the permissions of the tomcat8 user.
References
| Link | Resource |
|---|---|
| http://packetstormsecurity.com/files/163203/Cisco-HyperFlex-HX-Data-Platform-File-Upload-Remote-Code-Execution.html | Exploit Third Party Advisory VDB Entry |
| https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hyperflex-upload-KtCK8Ugz | Vendor Advisory |
Configurations
Configuration 1 (hide)
| AND |
|
History
01 Jan 2022, 18:06
| Type | Values Removed | Values Added |
|---|---|---|
| References | (MISC) http://packetstormsecurity.com/files/163203/Cisco-HyperFlex-HX-Data-Platform-File-Upload-Remote-Code-Execution.html - Exploit, Third Party Advisory, VDB Entry |
17 Jun 2021, 20:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
17 May 2021, 14:02
| Type | Values Removed | Values Added |
|---|---|---|
| References | (CISCO) https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hyperflex-upload-KtCK8Ugz - Vendor Advisory | |
| CVSS |
v2 : v3 : |
v2 : 5.0
v3 : 5.3 |
| CPE | cpe:2.3:h:cisco:hyperflex_hx240c_af_m5:-:*:*:*:*:*:*:* cpe:2.3:o:cisco:hyperflex_hx_data_platform:*:*:*:*:*:*:*:* cpe:2.3:h:cisco:hyperflex_hx220c_all_nvme_m5:-:*:*:*:*:*:*:* cpe:2.3:h:cisco:hyperflex_hx240c:-:*:*:*:*:*:*:* cpe:2.3:h:cisco:hyperflex_hx220c_edge_m5:-:*:*:*:*:*:*:* cpe:2.3:h:cisco:hyperflex_hx220c_af_m5:-:*:*:*:*:*:*:* cpe:2.3:h:cisco:hyperflex_hx240c_m5:-:*:*:*:*:*:*:* cpe:2.3:h:cisco:hyperflex_hx220c_m5:-:*:*:*:*:*:*:* |
06 May 2021, 13:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2021-05-06 13:15
Updated : 2023-12-10 13:55
NVD link : CVE-2021-1499
Mitre link : CVE-2021-1499
CVE.ORG link : CVE-2021-1499
JSON object : View
Products Affected
cisco
- hyperflex_hx220c_edge_m5
- hyperflex_hx240c_af_m5
- hyperflex_hx220c_all_nvme_m5
- hyperflex_hx220c_af_m5
- hyperflex_hx_data_platform
- hyperflex_hx240c
- hyperflex_hx220c_m5
- hyperflex_hx240c_m5
CWE
CWE-306
Missing Authentication for Critical Function