8.1

CVE-2021-1227

Cisco NX-OS Software NX-API Cross-Site Request Forgery Vulnerability

A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system. This vulnerability is due to insufficient CSRF protections for the NX-API on an affected device. An attacker could exploit this vulnerability by persuading a user of the NX-API to follow a malicious link. A successful exploit could allow the attacker to perform arbitrary actions with the privilege level of the affected user. The attacker could view and modify the device configuration. Note: The NX-API feature is disabled by default.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Cisco ≫ Nx-os Version 8.4(2a)
   Cisco ≫ Mds 9148s Version -
   Cisco ≫ Mds 9250i Version -
   Cisco ≫ Mds 9706 Version -
   Cisco ≫ Mds 9710 Version -
   Cisco ≫ Nexus 7000 Version -
   Cisco ≫ Nexus 7700 Version -
Cisco ≫ Nx-os Version 8.4(3)
   Cisco ≫ Mds 9148s Version -
   Cisco ≫ Mds 9250i Version -
   Cisco ≫ Mds 9706 Version -
   Cisco ≫ Mds 9710 Version -
   Cisco ≫ Nexus 7000 Version -
   Cisco ≫ Nexus 7700 Version -
Cisco ≫ Nx-os Version 8.4(3)s19
   Cisco ≫ Mds 9148s Version -
   Cisco ≫ Mds 9250i Version -
   Cisco ≫ Mds 9706 Version -
   Cisco ≫ Mds 9710 Version -
   Cisco ≫ Nexus 7000 Version -
   Cisco ≫ Nexus 7700 Version -
Cisco ≫ Nx-os Version 9.3(3)idi9(0.569)
   Cisco ≫ Nexus 3048 Version -
   Cisco ≫ Nexus 31108pv-v Version -
   Cisco ≫ Nexus 31108tc-v Version -
   Cisco ≫ Nexus 31128pq Version -
   Cisco ≫ Nexus 3132c-z Version -
   Cisco ≫ Nexus 3132q-v Version -
   Cisco ≫ Nexus 3132q-x Version -
   Cisco ≫ Nexus 3132q-xl Version -
   Cisco ≫ Nexus 3164q Version -
   Cisco ≫ Nexus 3172pq Version -
   Cisco ≫ Nexus 3172pq-xl Version -
   Cisco ≫ Nexus 3232c Version -
   Cisco ≫ Nexus 3264c-e Version -
   Cisco ≫ Nexus 3264q Version -
   Cisco ≫ Nexus 3408-s Version -
   Cisco ≫ Nexus 34180yc Version -
   Cisco ≫ Nexus 3432d-s Version -
   Cisco ≫ Nexus 3464c Version -
   Cisco ≫ Nexus 3524-x Version -
   Cisco ≫ Nexus 3524-xl Version -
   Cisco ≫ Nexus 3548-x Version -
   Cisco ≫ Nexus 3548-xl Version -
   Cisco ≫ Nexus 36180yc-r Version -
   Cisco ≫ Nexus 3636c-r Version -
   Cisco ≫ Nexus 9200 Version -
   Cisco ≫ Nexus 9300 Version -
   Cisco ≫ Nexus 9500 Version -
Cisco ≫ Nx-os Version 7.3(8)n1(0.809)
   Cisco ≫ Nexus 5548p Version -
   Cisco ≫ Nexus 5548up Version -
   Cisco ≫ Nexus 5596t Version -
   Cisco ≫ Nexus 5596up Version -
   Cisco ≫ Nexus 56128p Version -
   Cisco ≫ Nexus 5624q Version -
   Cisco ≫ Nexus 5648q Version -
   Cisco ≫ Nexus 5672up Version -
   Cisco ≫ Nexus 5672up-16g Version -
   Cisco ≫ Nexus 5696q Version -
   Cisco ≫ Nexus 6001 Version -
   Cisco ≫ Nexus 6004 Version -
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.67% 0.47
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 8.1 2.8 5.2
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
NIST 5.8 8.6 4.9
AV:N/AC:M/Au:N/C:P/I:P/A:N
Cisco PSIRT 8.1 2.8 5.2
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
CWE-352 Cross-Site Request Forgery (CSRF)

The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxos-nxapi-csrf-wRMzWL9z
Vendor Advisory