CVE-2021-1258
Assigner: cisco
Published: 2021-01-13T00:00:00
State: PUBLISHED
affected: product: Cisco AnyConnect Secure Mobility Client 
vendor: Cisco
versions: status: affected
version: n/a
datePublic: 2021-01-13T00:00:00
descriptions: value: A vulnerability in the upgrade component of Cisco AnyConnect Secure Mobility Client could allow an authenticated, local attacker with low privileges to read arbitrary files on the underlying operating system (OS) of an affected device. The vulnerability is due to insufficient file permission restrictions. An attacker could exploit this vulnerability by sending a crafted command from the local CLI to the application. A successful exploit could allow the attacker to read arbitrary files on the underlying OS of the affected device. The attacker would need to have valid user credentials to exploit this vulnerability.
exploits: value: The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory. 
metrics: cvssV3_1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 5.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
version: 3.1
problemTypes: descriptions: cweId: CWE-264
description: CWE-264
type: CWE
source: advisory: cisco-sa-anyconnect-fileread-PbHbgHMj
defect: CSCvu75418
discovery: INTERNAL
title: Cisco AnyConnect Secure Mobility Client Arbitrary File Read Vulnerability