Vulnerability Description
A vulnerability in an API endpoint of Cisco ACI Multi-Site Orchestrator (MSO) installed on the Application Services Engine could allow an unauthenticated, remote attacker to bypass authentication on an affected device. The vulnerability is due to improper token validation on a specific API endpoint. An attacker could exploit this vulnerability by sending a crafted request to the affected API. A successful exploit could allow the attacker to receive a token with administrator-level privileges that could be used to authenticate to the API on affected MSO and managed Cisco Application Policy Infrastructure Controller (APIC) devices.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Cisco | Aci Multi-Site Orchestrator | >= 3.0, < 3.0\(3m\) |
| Cisco | Application Policy Infrastructure Controller | 3.0\(3i\) |
Related Weaknesses (CWE)
References
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-mVendor Advisory
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-mVendor Advisory
FAQ
What is CVE-2021-1388?
CVE-2021-1388 is a vulnerability with a CVSS score of 10.0 (CRITICAL). A vulnerability in an API endpoint of Cisco ACI Multi-Site Orchestrator (MSO) installed on the Application Services Engine could allow an unauthenticated, remote attacker to bypass authentication on a...
How severe is CVE-2021-1388?
CVE-2021-1388 has been rated CRITICAL with a CVSS base score of 10.0/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2021-1388?
Check the references section above for vendor advisories and patch information. Affected products include: Cisco Aci Multi-Site Orchestrator, Cisco Application Policy Infrastructure Controller.