CVE-2021-1385
Assigner: cisco
Published: 2021-03-24T00:00:00
State: PUBLISHED
affected: product: Cisco IOS 
vendor: Cisco
versions: status: affected
version: n/a
datePublic: 2021-03-24T00:00:00
descriptions: value: A vulnerability in the Cisco IOx application hosting environment of multiple Cisco platforms could allow an authenticated, remote attacker to conduct directory traversal attacks and read and write files on the underlying operating system or host system. This vulnerability occurs because the device does not properly validate URIs in IOx API requests. An attacker could exploit this vulnerability by sending a crafted API request that contains directory traversal character sequences to an affected device. A successful exploit could allow the attacker to read or write arbitrary files on the underlying operating system.
exploits: value: The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory. 
metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
version: 3.1
problemTypes: descriptions: cweId: CWE-22
description: CWE-22
type: CWE
source: advisory: cisco-sa-iox-pt-hWGcPf7g
defect: CSCvw64810
CSCvx21776
CSCvx21783
discovery: INTERNAL
title: Cisco IOx Application Environment Path Traversal Vulnerability