SB2021112903 - Multiple vulnerabilities in Cisco Security Manager 

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2021112903

SB2021112903 - Multiple vulnerabilities in Cisco Security Manager

Published: November 29, 2021 Updated: December 18, 2023

Security Bulletin ID SB2021112903
Severity
High
Patch available
NO
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

High 50% Medium 50%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.


1) NULL pointer dereference (CVE-ID: CVE-2021-34798)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error. A remote attacker can send a specially crafted HTTP request to the affected web server and perform a denial of service (DoS) attack.


2) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2021-40438)

The disclosed vulnerability allows a remote attacker to perform SSRF attacks.

The vulnerability exists due to insufficient validation of user-supplied input within the mod_proxy module in Apache HTTP Server. A remote attacker can send a specially crafted HTTP request with a chosen uri-path and trick the web server to initiate requests to arbitrary systems.

Successful exploitation of this vulnerability may allow a remote attacker gain access to sensitive data, located in the local network or send malicious requests to other servers from the vulnerable system.


Remediation

Cybersecurity Help is not aware of any official remediation provided by the vendor.

References