CVE-2021-1235
Assigner: cisco
Published: 2021-01-20T00:00:00
State: PUBLISHED
affected: product: Cisco SD-WAN vManage 
vendor: Cisco
versions: status: affected
version: n/a
datePublic: 2021-01-20T00:00:00
descriptions: value: A vulnerability in the CLI of Cisco SD-WAN vManage Software could allow an authenticated, local attacker to read sensitive database files on an affected system. The vulnerability is due to insufficient user authorization. An attacker could exploit this vulnerability by accessing the vshell of an affected system. A successful exploit could allow the attacker to read database files from the filesystem of the underlying operating system.
exploits: value: The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory. 
metrics: cvssV3_0: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 5.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
version: 3.0
problemTypes: descriptions: cweId: CWE-497
description: CWE-497
type: CWE
source: advisory: cisco-sa-sdwan-vinfdis-MC8L58dj
defect: CSCvs11276
discovery: INTERNAL
title: Cisco SD-WAN vManage Information Disclosure Vulnerability