PT-2021-3493 · Cisco · Cisco Business Process Automation

Published 2021-07-07 · Updated 2022-08-05 · CVE-2021-1576

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco Business Process Automation (affected versions not specified)

Description The issue is related to improper authorization settings for management commands and access to action logs. This could allow a remote attacker to elevate privileges by sending specially crafted HTTP messages. The vulnerabilities are due to improper authorization enforcement for specific features and for access to log files that contain confidential information. An attacker could exploit these vulnerabilities by submitting crafted HTTP messages to an affected system, performing unauthorized actions with the privileges of an administrator, or by retrieving sensitive data from the logs and using it to impersonate a legitimate privileged user.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Using Hardcoded Credentials

Improper Authorization

Weakness Enumeration

CWE-798

CWE-285

Related Identifiers

BDU:2021-03523

CVE-2021-1576

Affected Products

Cisco Business Process Automation

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2021-1576 · Security Note
• https://bdu.fstec.ru/vul/2021-03523 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-bpa-priv-esc-dgubwbH4 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-1576 · Vendor Advisory
• https://safe-surf.ru/upload/VULN/VULN-20210709.2.pdf · Security Note
• https://t.me/cvenotify/17525 · Telegram Post