CVE-2021-34751

{"id": "CVE-2021-34751", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "ykramarz@cisco.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "published": "2024-11-15T17:15:09.883", "references": [{"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-infodisc-Ft2WVmNU", "source": "ykramarz@cisco.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Primary", "source": "ykramarz@cisco.com", "description": [{"lang": "en", "value": "CWE-317"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability in the administrative web-based GUI configuration manager of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to access sensitive configuration information. The attacker would require low privilege credentials on an affected device.\r\nThis vulnerability exists because of improper encryption of sensitive information stored within the GUI configuration manager. An attacker could exploit this vulnerability by logging into the GUI of Cisco FMC Software and navigating to certain sensitive configurations. A successful exploit could allow the attacker to view sensitive configuration parameters in clear text.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.[[Publication_URL{Layout()}]]This advisory is part of the October 2021 release of the Cisco ASA, FTD, and FMC Security Advisory Bundled publication. For a complete list of the advisories and links to them, see . "}, {"lang": "es", "value": "Una vulnerabilidad en el administrador de configuraci\u00f3n de la interfaz gr\u00e1fica de usuario (GUI) administrativa basada en la Web del software Cisco Firepower Management Center (FMC) podr\u00eda permitir que un atacante remoto autenticado acceda a informaci\u00f3n de configuraci\u00f3n confidencial. El atacante requerir\u00eda credenciales con pocos privilegios en un dispositivo afectado. Esta vulnerabilidad existe debido al cifrado incorrecto de la informaci\u00f3n confidencial almacenada en el administrador de configuraci\u00f3n de la interfaz gr\u00e1fica de usuario. Un atacante podr\u00eda aprovechar esta vulnerabilidad iniciando sesi\u00f3n en la interfaz gr\u00e1fica de usuario del software Cisco FMC y navegando a determinadas configuraciones confidenciales. Una explotaci\u00f3n exitosa podr\u00eda permitir al atacante ver par\u00e1metros de configuraci\u00f3n confidenciales en texto plano. Cisco ha publicado actualizaciones de software que solucionan esta vulnerabilidad. No existen workarounds que solucionen esta vulnerabilidad. [[Publication_URL{Layout()}]] Este aviso es parte de la versi\u00f3n de octubre de 2021 de la publicaci\u00f3n Cisco ASA, FTD y FMC Security Advisory Bundled. Para obtener una lista completa de los avisos y los v\u00ednculos a ellos, consulte . "}], "lastModified": "2024-11-18T17:11:56.587", "sourceIdentifier": "ykramarz@cisco.com"}