CVE-2021-34764CWE-601CWE-79cross-site-scripting

CVE-2021-34764

Medium · published October 27, 2021

CVSS v3.1
4.8
EPSS
1%
Percentile
48.9
In the wild
Unconfirmed
What it is

Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an attacker to execute a cross-site scripting (XSS) attack or an open redirect attack. For more information about these vulnerabilities, see the Details section of this advisory.

The record
Technical detail
CVSS v3.1
4.8 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00616 · 48.9th percentile
Weaknesses
CWE-601 · URL Redirection to Untrusted Site ('Open Redirect'); CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2021-10-27T23:15Z
Affected products (25)
ProductVersionsFixed in
cisco/firepower_management_center_virtual_applianceall versions—
cisco/firepower_management_center_virtual_applianceall versions—
cisco/firepower_management_center_virtual_applianceall versions—
cisco/firepower_management_center_virtual_applianceall versions—
cisco/firepower_management_center_virtual_applianceall versions—
cisco/firepower_management_center_virtual_applianceall versions—
cisco/firepower_management_center_virtual_applianceall versions—
cisco/firepower_management_center_virtual_applianceall versions—
cisco/firepower_management_center_virtual_applianceall versions—
cisco/firepower_management_center_virtual_applianceall versions—
cisco/firepower_management_center_virtual_applianceall versions—
cisco/secure_firewall_threat_defense< 6.4.0.136.4.0.13
cisco/secure_firewall_threat_defense≥ 6.5.0, < 6.6.56.6.5
cisco/secure_firewall_threat_defense≥ 6.7.0, < 6.7.0.36.7.0.3
cisco/sourcefire_defense_centerall versions—
cisco/sourcefire_defense_centerall versions—
cisco/sourcefire_defense_centerall versions—
cisco/sourcefire_defense_centerall versions—
cisco/sourcefire_defense_centerall versions—
cisco/sourcefire_defense_centerall versions—
cisco/sourcefire_defense_centerall versions—
cisco/sourcefire_defense_centerall versions—
cisco/sourcefire_defense_centerall versions—
cisco/sourcefire_defense_centerall versions—
cisco/sourcefire_defense_centerall versions—
References (2)
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-xss-openredir-TVPMWJyg · [email protected]https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-xss-openredir-TVPMWJyg · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 27 OCT 18:55Z
    Cisco Firepower Management Center Software Cross-Site Scripting and Open Redirect Vulnerabilities
    cvelistv5