CVE-2021-1388 | A vulnerability in an API endpoint of Cisco ACI Multi-Site O… | CVSS 10.0 CRITICAL

Description

A vulnerability in an API endpoint of Cisco ACI Multi-Site Orchestrator (MSO) installed on the Application Services Engine could allow an unauthenticated, remote attacker to bypass authentication on an affected device. The vulnerability is due to improper token validation on a specific API endpoint. An attacker could exploit this vulnerability by sending a crafted request to the affected API. A successful exploit could allow the attacker to receive a token with administrator-level privileges that could be used to authenticate to the API on affected MSO and managed Cisco Application Policy Infrastructure Controller (APIC) devices.

Metadata

CVE ID: CVE-2021-1388
State: PUBLISHED
Assigner: cisco
Reserved: 2020-11-13 00:00 UTC
Published: 2021-02-24 19:30 UTC
Last updated: 2024-11-08 23:37 UTC
Primary CWE: CWE-269
CWE-269
Vendor / Product: Cisco / Cisco ACI Multi-Site Orchestrator Software
Sources: cve.org · NVD

Severity & Metrics

10.0 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

SSVC — CISA Coordinator

Exploitation: none
Automatable: yes
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
Cisco	Cisco ACI Multi-Site Orchestrator Software	—	n/a

Weakness (CWE)

CWE	Source	Description
CWE-269	cna	CWE-269

CVSS scores (1)

Score	Severity	Version	Source	Vector
10.0	CRITICAL	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

References (1)

20210224 Cisco ACI Multi-Site Orchestrator Application Services Engine Deployment Authentication Bypass Vulnerability https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-mso-authbyp-bb5GmBQv