Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager Information Disclosure Vulnerability (Cisco Cisco Prime Infrastructure)

CVE-2021-34733
MEDIUM 5.5

At a glance

Source
NVD
EPSS
EPSS 0.22 % · percentile 13 ()
State
PUBLISHED
Published
Updated
Assigner
cisco
NVD status
Modified

Description

A vulnerability in the CLI of Cisco Prime Infrastructure and Cisco Evolved Programmable Network (EPN) Manager could allow an authenticated, local attacker to access sensitive information stored on the underlying file system of an affected system. This vulnerability exists because sensitive information is not sufficiently secured when it is stored. An attacker could exploit this vulnerability by gaining unauthorized access to sensitive information on an affected system. A successful exploit could allow the attacker to create forged authentication requests and gain unauthorized access to the affected system.

Weaknesses (CWE)

  • CWE-522 — Insufficiently Protected Credentials

References

Scores

VersionScoreVectorScored by
CVSS 3.1MEDIUM 5.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:Ncisco
CVSS 3.1MEDIUM 5.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NNVD · psirt@cisco.com (Secondary)
CVSS 3.1MEDIUM 5.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NNVD · nvd@nist.gov (Primary)
CVSS 2.0LOW 2.1AV:L/AC:L/Au:N/C:P/I:N/A:NNVD · nvd@nist.gov (Primary)

European references

Affected configurations (NVD CPE)

Affected products

ProductVersions
Cisco · Cisco Prime Infrastructureaffected n/a

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD