CVE-2021-1359: cisco web security appliance +1 lainnya

csirt@kutim:~/threat-intel/cve/CVE-2021-1359

CVSS 8.8 · High EPSS 1,9%

Kerentanan Missing XML Validation pada cisco web security appliance, cisco asyncos. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

A vulnerability in the configuration management of Cisco AsyncOS for Cisco Web Security Appliance (WSA) could allow an authenticated, remote attacker to perform command injection and elevate privileges to root. This vulnerability is due to insufficient validation of user-supplied XML input for the web interface. An attacker could exploit this vulnerability by uploading crafted XML configuration files that contain scripting code to a vulnerable device. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system and elevate privileges to root. An attacker would need a valid user account with the rights to upload configuration files to exploit this vulnerability.

Rincian

Terbit di NVD: 8 Juli 2021
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-112: Missing XML Validation
EPSS (30 hari): 1,9% peluang dieksploitasi; lebih tinggi dari 78,9% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
cisco	web security appliance	Versi 11.8.0-429
cisco	web security appliance	Versi 11.8.0-453
cisco	asyncos	Versi 11.8.0 hingga sebelum 12.0.3-005
cisco	asyncos	Versi 12.5.0 hingga sebelum 12.5.2

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-scr-web-priv-esc-k3HCGJZ advisory vendor

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.