HIGH✓ PATCH🇵🇱 Wersja polska

CVE-2021-34762

CVSS 8.1v3.1pub. 2021-10-27upd. 2024-11-21

A vulnerability in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to perform a directory traversal attack on an affected device. The attacker would require valid device credentials. The vulnerability is due to insufficient input validation of the HTTPS URL by the web-based management interface. An attacker could exploit this vulnerability by sending a crafted HTTPS request that contains directory traversal character sequences to an affected device. A successful exploit could allow the attacker to read or write arbitrary files on the device.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

  • Cisco Firepower Management Center Virtual Appliance

    APP
    Cisco
    6.2.36.4.06.5.06.6.16.6.26.6.36.6.46.7.07.0.07.1.0

  • Cisco Firepower Threat Defense

    APP
    Cisco
    < 6.4.0.136.5.0 – 6.6.5 (bez)6.7.0 – 6.7.0.3 (bez)7.0.0 – 7.0.1 (bez)

  • Cisco Sourcefire Defense Center

    APP
    Cisco
    6.2.36.4.06.5.06.6.16.6.26.6.36.6.47.0.0
🟢
PATCH AVAILABLE
Vendor update available. Deploy in standard maintenance cycle.
Tags
Path Traversal
CWE
References

Related vulnerabilities

CVE-2025-20333CRITICAL9.9⚠ KEVPL ✓ten sam produkt

RCE jako root w Cisco ASA i FTD poprzez podatny serwer VPN web

CVE-2025-20363CRITICAL9.0PL ✓ten sam produkt

RCE w web services Cisco ASA, FTD, IOS, IOS XE, IOS XR przez HTTP

CVE-2024-20412CRITICAL9.3PL ✓ten sam produkt

Cisco FTD: statyczne konta z zakodowanymi hasłami umożliwiają nieautoryzowany dostęp

CVE-2020-3187CRITICAL9.1ten sam produkt

A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Fi...

CVE-2018-0101CRITICAL10.0ten sam produkt

A vulnerability in the Secure Sockets Layer (SSL) VPN functionality of the Cisco Adaptive Security Appliance (...