CVE-2021-1574

Multiple vulnerabilities in the web-based management interface of Cisco Business Process Automation (BPA) could allow an authenticated, remote attacker to elevate privileges to Administrator. These vulnerabilities are due to improper authorization enforcement for specific features and for access to log files that contain confidential information. An attacker could exploit these vulnerabilities either by submitting crafted HTTP messages to an affected system and performing unauthorized actions with the privileges of an administrator, or by retrieving sensitive data from the logs and using it to impersonate a legitimate privileged user. A successful exploit could allow the attacker to elevate privileges to Administrator.

• CWE-285
• CWE-798

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-bpa-priv-esc-dgubwbH4Vendor Advisory
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-bpa-priv-esc-dgubwbH4Vendor Advisory

Published

Jul 8, 2021

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-1568A vulnerability in Cisco AnyConnect Secure Mobility Client f…5.5
• CVE-2021-1569Multiple vulnerabilities in Cisco Jabber for Windows, Cisco …6.5
• CVE-2021-1570Multiple vulnerabilities in Cisco Jabber for Windows, Cisco …6.5
• CVE-2021-1571Multiple vulnerabilities in the web-based management interfa…6.1
• CVE-2021-1572A vulnerability in ConfD could allow an authenticated, local…7.8
• CVE-2021-1573A vulnerability in the web services interface of Cisco Adapt…7.5
• CVE-2021-1575A vulnerability in the web-based management interface of Cis…6.1
• CVE-2021-1576Multiple vulnerabilities in the web-based management interfa…8.8
• CVE-2021-1577A vulnerability in an API endpoint of Cisco Application Poli…9.1
• CVE-2021-1578A vulnerability in an API endpoint of Cisco Application Poli…8.8
• CVE-2021-1579A vulnerability in an API endpoint of Cisco Application Poli…8.8
• CVE-2021-1580Multiple vulnerabilities in the web UI and API endpoints of …7.2