Path Traversal in Cisco Network Services Orchestrator
CVE-2021-1132
A vulnerability in the API subsystem and in the web-management interface of Cisco Network Services Orchestrator (NSO) could allow an unauthenticated, remote attacker to access sensitive data. This vulnerability exists because the web-management interface and certain HTTP-based APIs do not properly validate user-supplied input. An attacker could exploit this vulnerability by sending a crafted HTTP request that contains directory traversal character sequences to an affected system. A successful exploit could allow the attacker to access sensitive files on the affected system.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
EPSS: 0.016 (74.6th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N.
Affected products
- Cisco Network Services Orchestrator — versions 5.3.1, 5.4.0.1, 5.4
- Cisco Network_services_orchestrator — versions 5.3.1, 5.4, 5.4.0.1
Weakness classification (CWE)
References
- psirt@cisco.com (Vendor Advisory)
- psirt@cisco.com (Not Applicable)
- psirt@cisco.com (Not Applicable)
- psirt@cisco.com (Not Applicable)
- psirt@cisco.com (Not Applicable)
- psirt@cisco.com (Not Applicable)
Frequently asked questions
- What is CVE-2021-1132?
- CVE-2021-1132 is a medium-severity vulnerability in Cisco Network Services Orchestrator, classified under Path Traversal: '.../...//'. CVSS score: 5.3/10. Published 2024-11-18.
- How severe is CVE-2021-1132?
- Medium severity. CVSS v3 base score is 5.3 out of 10.