8.1

CVE-2021-1227

A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system. This vulnerability is due to insufficient CSRF protections for the NX-API on an affected device. An attacker could exploit this vulnerability by persuading a user of the NX-API to follow a malicious link. A successful exploit could allow the attacker to perform arbitrary actions with the privilege level of the affected user. The attacker could view and modify the device configuration. Note: The NX-API feature is disabled by default.

Data is provided by the National Vulnerability Database (NVD)
Cisco ≫ Nx-os Version8.4(2a)
   Cisco ≫ Mds 9148s Version-
   Cisco ≫ Mds 9250i Version-
   Cisco ≫ Mds 9706 Version-
   Cisco ≫ Mds 9710 Version-
   Cisco ≫ Nexus 7000 Version-
   Cisco ≫ Nexus 7700 Version-
Cisco ≫ Nx-os Version8.4(3)
   Cisco ≫ Mds 9148s Version-
   Cisco ≫ Mds 9250i Version-
   Cisco ≫ Mds 9706 Version-
   Cisco ≫ Mds 9710 Version-
   Cisco ≫ Nexus 7000 Version-
   Cisco ≫ Nexus 7700 Version-
Cisco ≫ Nx-os Version8.4(3)s19
   Cisco ≫ Mds 9148s Version-
   Cisco ≫ Mds 9250i Version-
   Cisco ≫ Mds 9706 Version-
   Cisco ≫ Mds 9710 Version-
   Cisco ≫ Nexus 7000 Version-
   Cisco ≫ Nexus 7700 Version-
Cisco ≫ Nx-os Version9.3(3)idi9(0.569)
   Cisco ≫ Nexus 3048 Version-
   Cisco ≫ Nexus 31108pv-v Version-
   Cisco ≫ Nexus 31108tc-v Version-
   Cisco ≫ Nexus 31128pq Version-
   Cisco ≫ Nexus 3132c-z Version-
   Cisco ≫ Nexus 3132q-v Version-
   Cisco ≫ Nexus 3132q-x Version-
   Cisco ≫ Nexus 3132q-xl Version-
   Cisco ≫ Nexus 3164q Version-
   Cisco ≫ Nexus 3172pq Version-
   Cisco ≫ Nexus 3172pq-xl Version-
   Cisco ≫ Nexus 3232c Version-
   Cisco ≫ Nexus 3264c-e Version-
   Cisco ≫ Nexus 3264q Version-
   Cisco ≫ Nexus 3408-s Version-
   Cisco ≫ Nexus 34180yc Version-
   Cisco ≫ Nexus 3432d-s Version-
   Cisco ≫ Nexus 3464c Version-
   Cisco ≫ Nexus 3524-x Version-
   Cisco ≫ Nexus 3524-xl Version-
   Cisco ≫ Nexus 3548-x Version-
   Cisco ≫ Nexus 3548-xl Version-
   Cisco ≫ Nexus 36180yc-r Version-
   Cisco ≫ Nexus 3636c-r Version-
   Cisco ≫ Nexus 9200 Version-
   Cisco ≫ Nexus 9300 Version-
   Cisco ≫ Nexus 9500 Version-
Cisco ≫ Nx-os Version7.3(8)n1(0.809)
   Cisco ≫ Nexus 5548p Version-
   Cisco ≫ Nexus 5548up Version-
   Cisco ≫ Nexus 5596t Version-
   Cisco ≫ Nexus 5596up Version-
   Cisco ≫ Nexus 56128p Version-
   Cisco ≫ Nexus 5624q Version-
   Cisco ≫ Nexus 5648q Version-
   Cisco ≫ Nexus 5672up Version-
   Cisco ≫ Nexus 5672up-16g Version-
   Cisco ≫ Nexus 5696q Version-
   Cisco ≫ Nexus 6001 Version-
   Cisco ≫ Nexus 6004 Version-
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.38% 0.562
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 8.1 2.8 5.2
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
nvd@nist.gov 5.8 8.6 4.9
AV:N/AC:M/Au:N/C:P/I:P/A:N
psirt@cisco.com 8.1 2.8 5.2
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
CWE-352 Cross-Site Request Forgery (CSRF)

The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.