PT-2021-7487 · Cisco · Cisco Nexus Insights

Published 2021-09-01 · Updated 2021-09-15 · CVE-2021-34765

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cisco Nexus Insights (affected versions not specified)

Description The issue is related to the web interface of Cisco Nexus Insights, where a vulnerability allows an authenticated, remote attacker to view and download files related to the web application. This is due to the lack of proper role-based access control (RBAC) filters applied to file download actions. An attacker with valid device credentials could exploit this by logging in and navigating to the directory listing and download functions, potentially leading to the disclosure of sensitive information.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Files Accessible to External Parties

Weakness Enumeration

CWE-552

Related Identifiers

BDU:2022-06803

CVE-2021-34765

Affected Products

Cisco Nexus Insights

References · 5

• https://osv.dev/vulnerability/CVE-2021-34765 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-34765 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-insight-infodis-2By2ZpBB · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-06803 · Security Note
• https://t.me/cibsecurity/28205 · Telegram Post