PT-2021-4754 · Cisco · Cisco Umbrella

Abhinav Khanna · Published 2021-11-03 · Updated 2021-11-05 · CVE-2021-40126

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cisco Umbrella (affected versions not specified)

Description A vulnerability in the web-based dashboard of Cisco Umbrella could allow an authenticated, remote attacker to perform an email enumeration attack against the Umbrella infrastructure. This is due to an overly descriptive error message on the dashboard that appears when a user attempts to modify their email address when the new address already exists in the system. An attacker could exploit this by attempting to modify the user's email address, potentially allowing them to enumerate email addresses of users in the system.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Generation of Error Message Containing Sensitive Information

Weakness Enumeration

CWE-210

CWE-209

Related Identifiers

BDU:2021-05471

CVE-2021-40126

Affected Products

Cisco Umbrella

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2021-40126 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-umbrella-user-enum-S7XfJwDE · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-05471 · Security Note