CVE-2021-34764 Cisco Firepower Management Center Software Cross-Site Scripting and Open Redirect Vulnerabilities
Attackers can execute cross-site scripting or open redirect attacks in the Cisco Firepower Management Center web interface.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2021-34764?
CVE-2021-34764 is a medium-severity cross-site scripting vulnerability in Cisco Secure Firewall Threat Defense, published on 27 Oct 2021. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an attacker to execute a cross-site scripting (XSS) attack or an open redirect attack. For more information about these vulnerabilities, see the Details section of this advisory.
Which versions are affected by CVE-2021-34764?
It affects 3 products.
Products include Cisco Firepower Management Center Virtual Appliance, Cisco Secure Firewall Threat Defense, Cisco Sourcefire Defense Center.
How do I fix CVE-2021-34764?
No fix has been published for CVE-2021-34764 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2021-34764 being exploited?
There is no known exploitation of CVE-2021-34764 in the wild and no public exploit code.
Other vulnerabilities in Cisco Secure Firewall Threat Defense
- CVE-2021-34781 Cisco Firepower Threat Defense Software SSH Connections Denial of Service Vulnerability
- CVE-2021-34762 Cisco Firepower Management Center Software Authenticated Directory Traversal Vulnerability
- CVE-2021-34755 Cisco Firepower Threat Defense Software Command Injection Vulnerabilities
- CVE-2021-34756 Cisco Firepower Threat Defense Software Command Injection Vulnerabilities
- CVE-2021-34763 Cisco Firepower Management Center Software Cross-Site Scripting and Open Redirect Vulnerabilities
Sources
Also known as GHSA-29vr-6hw6-5v65.