Description (CNA)
A vulnerability in the web-based management interface and in the API subsystem of Cisco Tetration could allow an authenticated, remote attacker to inject arbitrary commands to be executed with root-level privileges on the underlying operating system. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by submitting a crafted HTTP message to the affected system. A successful exploit could allow the attacker to execute commands with root-level privileges. To exploit this vulnerability, an attacker would need valid administrator-level credentials.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Cisco / Cisco Secure Workload | affected 2.2.1.41; affected 3.2.1.18; affected 3.3.2.50; affected 3.4.1.28; affected 3.4.1.34; affected 2.3.1.45; affected 2.3.1.41; affected 3.3.2.28; affected 3.1.1.59; affected 2.0.2.20; affected 2.1.1.33; affected 2.1.1.29; affected 3.2.1.28; affected 3.4.1.35; affected 3.1.1.65; affected 3.1.1.67; affected 2.0.1.34; affected 2.3.1.49; affected 2.2.1.39; affected 3.4.1.19; affected 3.3.2.23; affected 3.1.1.61; affected 3.1.1.54; affected 3.5.1.17; affected 3.3.2.33; affected 3.5.1.1; affected 2.3.1.53; affected 3.5.1.20; affected 3.5.1.30; affected 3.3.2.16; affected 3.4.1.6; affected 2.3.1.50; affected 2.3.1.52; affected 3.2.1.19; affected 2.2.1.35; affected 3.1.1.53; affected 3.1.1.70; affected 3.2.1.20; affected 3.5.1.2; affected 1.103.1.12; affected 2.3.1.51; affected 3.3.2.42; affected 3.4.1.1; affected 3.3.2.12; affected 2.1.1.31; affected 3.5.1.23; affected 3.3.2.53; affected 3.4.1.14; affected 3.3.2.2; affected 3.4.1.20; affected 3.3.2.35; affected 1.102.21; affected 3.3.2.5 |
CWE
CWE-78
References
- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-tetr-cmd-injc-skrwGO
- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-xss-FmbPu2pe
ADP enrichment
No English description supplied.
No references supplied.