PT-2021-3492 · Cisco · Cisco Business Process Automation

Published 2021-07-07 · Updated 2022-08-05 · CVE-2021-1574

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco Business Process Automation (affected versions not specified)

Description The issue is related to improper authorization enforcement in the web-based management interface, allowing an authenticated, remote attacker to elevate privileges to Administrator. This can be achieved by submitting crafted HTTP messages to an affected system, performing unauthorized actions with administrator privileges, or by retrieving sensitive data from logs to impersonate a legitimate privileged user. The vulnerabilities are due to incorrect authorization settings for management commands and access to log files containing confidential information.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Using Hardcoded Credentials

Improper Authorization

Weakness Enumeration

CWE-798

CWE-285

Related Identifiers

BDU:2021-03522

CVE-2021-1574

Affected Products

Cisco Business Process Automation

References · 5

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-bpa-priv-esc-dgubwbH4 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-1574 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-1574 · Security Note
• https://safe-surf.ru/upload/VULN/VULN-20210709.2.pdf · Security Note
• https://bdu.fstec.ru/vul/2021-03522 · Security Note