CVE-2021-1475 Cisco Umbrella Link and CSV Formula Injection Vulnerabilities
Authenticated attackers can inject malicious formulas or links into Cisco Umbrella audit logs and reports, potentially leading to code execution or security bypass.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2021-1475?
CVE-2021-1475 is a medium-severity vulnerability in Cisco Umbrella Insights Virtual Appliance, published on 8 Apr 2021. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Multiple vulnerabilities in the Admin audit log export feature and Scheduled Reports feature of Cisco Umbrella could allow an authenticated, remote attacker to perform formula and link injection attacks on an affected device. For more information about these vulnerabilities, see the Details section of this advisory.
Weakness: CWE-1236
Which versions are affected by CVE-2021-1475?
It affects 1 product.
Products include Cisco Umbrella.
How do I fix CVE-2021-1475?
No fix has been published for CVE-2021-1475 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-1475 being exploited?
There is no known exploitation of CVE-2021-1475 in the wild and no public exploit code.
Other vulnerabilities in Cisco Umbrella Insights Virtual Appliance
- CVE-2018-0435 Cisco Umbrella API Unauthorized Access Vulnerability
- CVE-2019-1807 Cisco Umbrella Dashboard Session Management Vulnerability
- CVE-2021-1474 Cisco Umbrella Link and CSV Formula Injection Vulnerabilities
- CVE-2019-1792 Cisco Umbrella Cross-Site Scripting Vulnerability
- CVE-2021-1350 Cisco Umbrella Dashboard Packet Flood Vulnerability
Sources
Also known as GHSA-639r-6p24-c5mm.