Vulnerability Description
A vulnerability in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to perform a directory traversal attack on an affected device. The attacker would require valid device credentials. The vulnerability is due to insufficient input validation of the HTTPS URL by the web-based management interface. An attacker could exploit this vulnerability by sending a crafted HTTPS request that contains directory traversal character sequences to an affected device. A successful exploit could allow the attacker to read or write arbitrary files on the device.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Cisco | Firepower Management Center Virtual Appliance | 6.2.3 |
| Cisco | Firepower Threat Defense | < 6.4.0.13 |
| Cisco | Sourcefire Defense Center | 6.2.3 |
Related Weaknesses (CWE)
References
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fVendor Advisory
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fVendor Advisory
FAQ
What is CVE-2021-34762?
CVE-2021-34762 is a vulnerability with a CVSS score of 8.1 (HIGH). A vulnerability in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to perform a directory traversal attack on an af...
How severe is CVE-2021-34762?
CVE-2021-34762 has been rated HIGH with a CVSS base score of 8.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2021-34762?
Check the references section above for vendor advisories and patch information. Affected products include: Cisco Firepower Management Center Virtual Appliance, Cisco Firepower Threat Defense, Cisco Sourcefire Defense Center.