Summary
Ein entfernter authentisierter oder lokaler Angreifer kann mehrere Schwachstellen im Cisco Application Policy Infrastructure Controller ausnutzen, um einen Cross-Site-Scripting-Angriff zu starten, beliebige Kommandos als Root auszuführen, vertrauliche Informationen preiszugeben und einen Denial-of-Service-Zustand zu verursachen.
Product
Der Cisco Application Policy Infrastructure Controller (APIC) ist die architektonische Hauptkomponente der Cisco Application Centric Infrastructure.
Vulnerabilities 4
-
Medium 6.0
Cisco Application Policy Infrastructure Controller Authenticated Local Denial of Service Vulnerability
A vulnerability in the system file permission handling of Cisco APIC could allow an authenticated, local attacker to overwrite critical system files, which could cause a DoS condition. To exploit this vulnerability, the attacker must have valid administrative…
-
Medium 5.1
Cisco Application Policy Infrastructure Controller Authenticated Command Injection Vulnerability
A vulnerability in the CLI of Cisco APIC could allow an authenticated, local attacker to execute arbitrary commands as root on the underlying operating system of an affected device. To exploit this vulnerability, the attacker must have valid administrati…
-
Medium 4.8
Cisco Application Policy Infrastructure Controller Stored Cross-Site Scripting Vulnerability
A vulnerability in the web UI of Cisco APIC could allow an authenticated, remote attacker to perform a stored XSS attack on an affected system. To exploit this vulnerability, the attacker must have valid administrative credentials. This vulnerability is due t…
-
Medium 4.4
Cisco Application Policy Infrastructure Controller Authenticated Command Injection Due to Sensitive Disclosure Vulnerability
A vulnerability in the implementation of the internal system processes of Cisco APIC could allow an authenticated, local attacker to access sensitive information on an affected device. To exploit this vulnerability, the attacker must have valid administrative…
Revision history
-
#1
Initiale Fassung
References
-
Cisco Security Advisory vom 2025-02-26
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apic-multi-vulns-9ummtg5