PT-2021-1835 · Cisco · Cisco Web Security Appliance+1

Alvaro Gutierrez · Published 2021-01-20 · Updated 2021-01-28 · CVE-2021-1271

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Cisco Web Security Appliance (WSA) versions (affected versions not specified)

Description A vulnerability in the web-based management interface of Cisco AsyncOS for Cisco Web Security Appliance could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface of an affected device. The issue exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this by inserting malicious data into a specific data field in an affected interface, potentially allowing the execution of arbitrary script code in the context of the affected interface.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2021-00595

CVE-2021-1271

Affected Products

Cisco Asyncos

Cisco Web Security Appliance

References · 6

• https://osv.dev/vulnerability/CVE-2021-1271 · Vendor Advisory
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-wsa-xss-RuB5WGqL · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-1271 · Security Note
• https://bdu.fstec.ru/vul/2021-00595 · Security Note
• https://t.me/cvenotify/9013 · Telegram Post
• https://t.me/cvenotify/8789 · Telegram Post