CVE-2021-40129

A vulnerability in the configuration dashboard of Cisco Common Services Platform Collector (CSPC) could allow an authenticated, remote attacker to submit a SQL query through the CSPC configuration dashboard. This vulnerability is due to insufficient input validation of uploaded files. An attacker could exploit this vulnerability by uploading a file containing a SQL query to the configuration dashboard. A successful exploit could allow the attacker to read restricted information from the CSPC SQL database.

Score

CVSS 3.1 4.9 Medium

Status

Modified - psirt@cisco.com

Published

2021-11-19

Last modified

2024-11-07

Weaknesses

CWE-89

Affected products

• Cisco Common Services Platform Collector Software (Cisco)
• Common Services Platform Collector (Cisco)

References

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-CSPC-SQLI-unVPTn5