6.1

CVE-2021-34764

Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an attacker to execute a cross-site scripting (XSS) attack or an open redirect attack. For more information about these vulnerabilities, see the Details section of this advisory.

Data is provided by the National Vulnerability Database (NVD)
Cisco ≫ Firepower Threat Defense Version < 6.4.0.13
Cisco ≫ Firepower Threat Defense Version >= 6.5.0 < 6.6.5
Cisco ≫ Firepower Threat Defense Version >= 6.7.0 < 6.7.0.3
Cisco ≫ Sourcefire Defense Center Version6.1.0
Cisco ≫ Sourcefire Defense Center Version6.2.0
Cisco ≫ Sourcefire Defense Center Version6.2.3
Cisco ≫ Sourcefire Defense Center Version6.3.0
Cisco ≫ Sourcefire Defense Center Version6.4.0
Cisco ≫ Sourcefire Defense Center Version6.5.0
Cisco ≫ Sourcefire Defense Center Version6.6.0
Cisco ≫ Sourcefire Defense Center Version6.6.1
Cisco ≫ Sourcefire Defense Center Version6.7.0
Cisco ≫ Sourcefire Defense Center Version7.0.0
Cisco ≫ Sourcefire Defense Center Version7.1.0
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.32% 0.523
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 6.1 2.8 2.7
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
nvd@nist.gov 5.8 8.6 4.9
AV:N/AC:M/Au:N/C:P/I:P/A:N
psirt@cisco.com 4.8 1.7 2.7
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
CWE-601 URL Redirection to Untrusted Site ('Open Redirect')

The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.