CVE-2021-1516
Last modified
CVE-2021-1516 is a medium-severity vulnerability rated 6.5/10 on the CVSS scale. A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Content Security Management Appliance (SMA), Cisco Email Security Appliance (ESA), and Cisco Web Security Appliance (WSA) could allow an authenticated, remote attacker to access sensitive information on an affected device. The vulnerability exists because confidential information is included in HTTP requests that are exchanged between the user and the device. EPSS estimates a 1.16% chance of exploitation in the next 30 days.
Description
A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Content Security Management Appliance (SMA), Cisco Email Security Appliance (ESA), and Cisco Web Security Appliance (WSA) could allow an authenticated, remote attacker to access sensitive information on an affected device. The vulnerability exists because confidential information is included in HTTP requests that are exchanged between the user and the device. An attacker could exploit this vulnerability by looking at the raw HTTP requests that are sent to the interface. A successful exploit could allow the attacker to obtain some of the passwords that are configured throughout the interface.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Cisco | Content Security Management Appliance | All versions |
| Cisco | Email Security Appliance | All versions |
| Cisco | Web Security Appliance | All versions |
| Cisco | Ironport Web Security Appliance | 13.6.2-023 |
| Cisco | Ironport Web Security Appliance | 14.0.0-090 |
| Cisco | Ironport Web Security Appliance | 14.0.0-133 |
| Cisco | Ironport Web Security Appliance | 14.0.0-292 |
| Cisco | Ironport Web Security Appliance | 14.0.0-300 |
References
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2021-1516?
How severe is CVE-2021-1516?
How do I fix CVE-2021-1516?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2021
- CVE-2021-1510Multiple vulnerabilities in Cisco SD-WAN vEdge Software coul…7.5
- CVE-2021-1511Multiple vulnerabilities in Cisco SD-WAN vEdge Software coul…6.5
- CVE-2021-1512A vulnerability in the CLI of Cisco SD-WAN Software could al…6
- CVE-2021-1513A vulnerability in the vDaemon process of Cisco SD-WAN Softw…7.5
- CVE-2021-1514A vulnerability in the CLI of Cisco SD-WAN Software could al…7.8
- CVE-2021-1515A vulnerability in Cisco SD-WAN vManage Software could allow…4.3
- CVE-2021-1517A vulnerability in the multimedia viewer feature of Cisco We…4.3
- CVE-2021-1518A vulnerability in the REST API of Cisco Firepower Device Ma…8.8
- CVE-2021-1519A vulnerability in the interprocess communication (IPC) chan…5.5
- CVE-2021-1520A vulnerability in the internal message processing of Cisco …6.7
- CVE-2021-1521A vulnerability in the Cisco Discovery Protocol implementati…6.5
- CVE-2021-1522A vulnerability in the change password API of Cisco Connecte…4.3
Are you affected by CVE-2021-1516?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST