CVE-2021-1143: falha de média gravidade em Cisco Connected Mobile Experiences
Cisco Connected Mobile Experiences User Enumeration Vulnerability
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 4.3epss 0.7%
A vulnerability in Cisco Connected Mobile Experiences (CMX) API authorizations could allow an authenticated, remote attacker to enumerate what users exist on the system. The vulnerability is due to a lack of authorization checks for certain API GET requests. An attacker could exploit this vulnerability by sending specific API GET requests to an affected device. A successful exploit could allow the attacker to enumerate users of the CMX system.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Produtos afetados
Cisco · Cisco Connected Mobile ExperiencesCVEs relacionadas — Cisco Connected Mobile Experiences
No mesmo produto, das mais perigosas para as menos.
CVE-2021-1144HIGHCisco Connected Mobile Experiences Privilege Escalation VulnerabilityEPSS 1.4%CVE-2021-1522MEDIUMCisco Connected Mobile Experiences Strong Authentication Requirements Enforcement BypassEPSS 0.7%CVE-2019-1645MEDIUMCisco Connected Mobile Experiences Information Disclosure VulnerabilityEPSS 0.5%CVE-2020-3152MEDIUMCisco Connected Mobile Experiences Privilege Escalation VulnerabilityEPSS 0.4%CVE-2020-3151MEDIUMCisco Connected Mobile Experiences Restricted Shell Escape VulnerabilityEPSS 0.3%