Cyber Resilience

CVE-2021-34762

High

Published: 27 October 2021

Published
27 October 2021
Modified
21 November 2024
KEV Added
Patch
CVSS Score v3.1 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
EPSS Score 0.0019 41.4th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2021-34762 is a high-severity Path Traversal: '/dir/../filename' (CWE-26) vulnerability in Cisco Firepower Management Center Virtual Appliance. Its CVSS base score is 8.1 (High).

Operationally, ranked at the 41.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

A vulnerability in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to perform a directory traversal attack on an affected device. The attacker would require valid device credentials. The vulnerability is…

more

due to insufficient input validation of the HTTPS URL by the web-based management interface. An attacker could exploit this vulnerability by sending a crafted HTTPS request that contains directory traversal character sequences to an affected device. A successful exploit could allow the attacker to read or write arbitrary files on the device.

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

cisco
firepower management center virtual appliance
6.2.3, 6.4.0, 6.5.0, 6.6.1, 6.6.2
cisco
firepower threat defense
≤ 6.4.0.13 · 6.5.0 — 6.6.5 · 6.7.0 — 6.7.0.3
cisco
sourcefire defense center
6.2.3, 6.4.0, 6.5.0, 6.6.1, 6.6.2

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-22

Validates pathnames and filenames to prevent traversal outside intended directories.

References