CVE-2021-1582CWE-79

Cisco Application Policy Infrastructure Controller Stored Cross-Site Scripting Vulnerability

Medium · published August 25, 2021

CVSS v3.1
5.4
EPSS
1%
Percentile
48.0
In the wild
Unconfirmed
What it is

A vulnerability in the web UI of Cisco Application Policy Infrastructure Controller (APIC) or Cisco Cloud APIC could allow an authenticated, remote attacker to perform a stored cross-site scripting attack on an affected system. This vulnerability is due to improper input validation in the web UI. An authenticated attacker could exploit this vulnerability by sending malicious input to the web UI. A successful exploit could allow the attacker to execute arbitrary script code in the context of the web-based interface or access sensitive, browser-based information.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00599 · 48.0th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2021-08-25T19:10Z
EPSS history
Timeline
  • 25 AUG 19:10Z
    Cisco Application Policy Infrastructure Controller Stored Cross-Site Scripting Vulnerability
    cvelistv5