CVE-2021-1132: cisco cisco network services orchestrator Path Traversal: '.../...//'

Vulnerability summary

CVE-2021-1132 is a high (CVSS 7.5) Path Traversal: '.../...//' vulnerability in cisco cisco network services orchestrator. EPSS estimates a 1.63% chance of exploitation in the next 30 days, higher than 75.7% of scored vulnerabilities.

Timeline

1. 18-11-2024
   PublishedVulnerability first disclosed.
2. 18-11-2024
   Last modifiedVulnerability information updated.

Description

A vulnerability in the API subsystem and in the web-management interface of Cisco Network Services Orchestrator (NSO) could allow an unauthenticated, remote attacker to access sensitive data. This vulnerability exists because the web-management interface and certain HTTP-based APIs do not properly validate user-supplied input. An attacker could exploit this vulnerability by sending a crafted HTTP request that contains directory traversal character sequences to an affected system. A successful exploit could allow the attacker to access sensitive files on the affected system.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

• CWE-35Path Traversal: '.../...//'The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '.../...//' (doubled triple dot slash) sequences that can resolve to a location that is outside of that directory.