CVE-2021-1132

Path Traversal: '.../...//' (CWE-35)

Published: Nov 18, 2024 / Updated: 1d ago

A vulnerability in the API subsystem and in the web-management interface of Cisco Network Services Orchestrator (NSO) could allow an unauthenticated, remote attacker to access sensitive data....

Cisco - MEDIUM - CVE-2021-1132 A vulnerability in the API subsystem and in the web-management interface of Cisco Network Services Orchestrator (NSO) could allow an unauthenticated, remote attacker to access sensitive data. This vulnerability exists because the web-management interface and certain HTTP-based APIs do not properly validate user-supplied input. An attacker could exploit this vulnerability by sending a crafted HTTP request that contains directory traversal character sequences to an affected system. A successful exploit could allow the attacker to access sensitive files on the affected system.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

A vulnerability, which was classified as problematic , was found in Cisco Network Services Orchestrator 5.3.1/5.4/5.4.0.1/5.4.0.2 . Affected is an unknown function of the component API Subsystem/Web-Management Interface . The manipulation leads to path traversal: '.../...//'. This vulnerability is traded as CVE-2021-1132 . It is possible to launch the attack remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability in the API subsystem and in the web-management interface of Cisco Network Services Orchestrator (NSO) could allow an unauthenticated, remote attacker to access sensitive data. This vulnerability exists because the web-management interface and certain HTTP-based APIs do not properly validate user-supplied input. An attacker could exploit this vulnerability by sending a crafted HTTP request that contains directory traversal character sequences to an affected system. A successful exploit could allow the attacker to access sensitive files on the affected system.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

A vulnerability in the API subsystem and in the web-management interface of Cisco Network Services Orchestrator (NSO) could allow an unauthenticated, remote attacker to access sensitive data. A successful exploit could allow the attacker to access sensitive files on the affected system.Cisco has released software updates that address this vulnerability.