cnvd - cnvd-2021-26115

CNVD-2021-26115

Vulnerability from cnvd - Published: 2021-04-09

Title

Cisco Umbrella CSV公式注入漏洞

Description

Cisco Umbrella是一个云安全平台，可提供抵御互联网威胁的第一道防线。 Cisco Umbrella的“管理员审核日志导出”功能存在CSV公式注入漏洞。该漏洞源于对CSV文件中的公式元素的中性化不当。攻击者可利用该漏洞将恶意公式元素注入CSV文件，从而可操纵CSV文件中的数据或实现代码执行。

Severity

中

Patch Name

Cisco Umbrella CSV公式注入漏洞的补丁

Patch Description

Cisco Umbrella是一个云安全平台，可提供抵御互联网威胁的第一道防线。 Cisco Umbrella的“管理员审核日志导出”功能存在CSV公式注入漏洞。该漏洞源于对CSV文件中的公式元素的中性化不当。攻击者可利用该漏洞将恶意公式元素注入CSV文件，从而可操纵CSV文件中的数据或实现代码执行。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description

厂商已发布了漏洞修复程序，请及时关注更新： https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-umbrella-inject-gbZGHP5T

Reference

https://nvd.nist.gov/vuln/detail/CVE-2021-1474

Impacted products

Name
Cisco Umbrella

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2021-1474",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2021-1474"
    }
  },
  "description": "Cisco Umbrella\u662f\u4e00\u4e2a\u4e91\u5b89\u5168\u5e73\u53f0\uff0c\u53ef\u63d0\u4f9b\u62b5\u5fa1\u4e92\u8054\u7f51\u5a01\u80c1\u7684\u7b2c\u4e00\u9053\u9632\u7ebf\u3002\n\nCisco Umbrella\u7684\u201c\u7ba1\u7406\u5458\u5ba1\u6838\u65e5\u5fd7\u5bfc\u51fa\u201d\u529f\u80fd\u5b58\u5728CSV\u516c\u5f0f\u6ce8\u5165\u6f0f\u6d1e\u3002\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u5bf9CSV\u6587\u4ef6\u4e2d\u7684\u516c\u5f0f\u5143\u7d20\u7684\u4e2d\u6027\u5316\u4e0d\u5f53\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5c06\u6076\u610f\u516c\u5f0f\u5143\u7d20\u6ce8\u5165CSV\u6587\u4ef6\uff0c\u4ece\u800c\u53ef\u64cd\u7eb5CSV\u6587\u4ef6\u4e2d\u7684\u6570\u636e\u6216\u5b9e\u73b0\u4ee3\u7801\u6267\u884c\u3002",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-umbrella-inject-gbZGHP5T",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2021-26115",
  "openTime": "2021-04-09",
  "patchDescription": "Cisco Umbrella\u662f\u4e00\u4e2a\u4e91\u5b89\u5168\u5e73\u53f0\uff0c\u53ef\u63d0\u4f9b\u62b5\u5fa1\u4e92\u8054\u7f51\u5a01\u80c1\u7684\u7b2c\u4e00\u9053\u9632\u7ebf\u3002\r\n\r\nCisco Umbrella\u7684\u201c\u7ba1\u7406\u5458\u5ba1\u6838\u65e5\u5fd7\u5bfc\u51fa\u201d\u529f\u80fd\u5b58\u5728CSV\u516c\u5f0f\u6ce8\u5165\u6f0f\u6d1e\u3002\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u5bf9CSV\u6587\u4ef6\u4e2d\u7684\u516c\u5f0f\u5143\u7d20\u7684\u4e2d\u6027\u5316\u4e0d\u5f53\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5c06\u6076\u610f\u516c\u5f0f\u5143\u7d20\u6ce8\u5165CSV\u6587\u4ef6\uff0c\u4ece\u800c\u53ef\u64cd\u7eb5CSV\u6587\u4ef6\u4e2d\u7684\u6570\u636e\u6216\u5b9e\u73b0\u4ee3\u7801\u6267\u884c\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Cisco Umbrella CSV\u516c\u5f0f\u6ce8\u5165\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": "Cisco Umbrella"
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2021-1474",
  "serverity": "\u4e2d",
  "submitTime": "2021-04-08",
  "title": "Cisco Umbrella CSV\u516c\u5f0f\u6ce8\u5165\u6f0f\u6d1e"
}

CVE-2021-1474 (GCVE-0-2021-1474)

Vulnerability from cvelistv5 – Published: 2021-04-08 04:07 – Updated: 2024-11-08 23:26

Summary

Multiple vulnerabilities in the Admin audit log export feature and Scheduled Reports feature of Cisco Umbrella could allow an authenticated, remote attacker to perform formula and link injection attacks on an affected device. For more information about these vulnerabilities, see the Details section of this advisory.

Severity ?

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

CWE

CWE-1236

Assigner

cisco

References

URL

Tags

https://tools.cisco.com/security/center/content/C…

vendor-advisoryx_refsource_CISCO

Impacted products

	Vendor	Product	Version
	Cisco	Cisco Umbrella Insights Virtual Appliance	Affected: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T16:11:17.469Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "20210407 Cisco Umbrella Link and CSV Formula Injection Vulnerabilities",
            "tags": [
              "vendor-advisory",
              "x_refsource_CISCO",
              "x_transferred"
            ],
            "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-umbrella-inject-gbZGHP5T"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-1474",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-08T20:45:38.668859Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-08T23:26:47.526Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Cisco Umbrella Insights Virtual Appliance",
          "vendor": "Cisco",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2021-04-07T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Multiple vulnerabilities in the Admin audit log export feature and Scheduled Reports feature of Cisco Umbrella could allow an authenticated, remote attacker to perform formula and link injection attacks on an affected device. For more information about these vulnerabilities, see the Details section of this advisory."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1236",
              "description": "CWE-1236",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-04-08T04:07:04",
        "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
        "shortName": "cisco"
      },
      "references": [
        {
          "name": "20210407 Cisco Umbrella Link and CSV Formula Injection Vulnerabilities",
          "tags": [
            "vendor-advisory",
            "x_refsource_CISCO"
          ],
          "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-umbrella-inject-gbZGHP5T"
        }
      ],
      "source": {
        "advisory": "cisco-sa-umbrella-inject-gbZGHP5T",
        "defect": [
          [
            "CSCvx27753",
            "CSCvx28555"
          ]
        ],
        "discovery": "INTERNAL"
      },
      "title": "Cisco Umbrella Link and CSV Formula Injection Vulnerabilities",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@cisco.com",
          "DATE_PUBLIC": "2021-04-07T16:00:00",
          "ID": "CVE-2021-1474",
          "STATE": "PUBLIC",
          "TITLE": "Cisco Umbrella Link and CSV Formula Injection Vulnerabilities"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Cisco Umbrella Insights Virtual Appliance",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Cisco"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Multiple vulnerabilities in the Admin audit log export feature and Scheduled Reports feature of Cisco Umbrella could allow an authenticated, remote attacker to perform formula and link injection attacks on an affected device. For more information about these vulnerabilities, see the Details section of this advisory."
            }
          ]
        },
        "exploit": [
          {
            "lang": "en",
            "value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory."
          }
        ],
        "impact": {
          "cvss": {
            "baseScore": "6.5",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L",
            "version": "3.0"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-1236"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "20210407 Cisco Umbrella Link and CSV Formula Injection Vulnerabilities",
              "refsource": "CISCO",
              "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-umbrella-inject-gbZGHP5T"
            }
          ]
        },
        "source": {
          "advisory": "cisco-sa-umbrella-inject-gbZGHP5T",
          "defect": [
            [
              "CSCvx27753",
              "CSCvx28555"
            ]
          ],
          "discovery": "INTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
    "assignerShortName": "cisco",
    "cveId": "CVE-2021-1474",
    "datePublished": "2021-04-08T04:07:04.808355Z",
    "dateReserved": "2020-11-13T00:00:00",
    "dateUpdated": "2024-11-08T23:26:47.526Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CNVD-2021-26115

CVE-2021-1474 (GCVE-0-2021-1474)

Tags

Sightings

Nomenclature