Cisco Common Services Platform Collector Improper Logging Restriction Vulnerability [CVE-2021-40130]
CVE number = CVE-2021-40130
A vulnerability in the web application of Cisco Common Services Platform Collector (CSPC) could allow an authenticated, remote attacker to specify non-log files as sources for syslog reporting.
This vulnerability is due to improper restriction of the syslog configuration. An attacker could exploit this vulnerability by configuring non-log files as sources for syslog reporting through the web application. A successful exploit could allow the attacker to read non-log files on the CSPC.
Cisco has released software updates that address this vulnerability.
There are no workarounds that address this vulnerability.
Vulnerable Products
At the time of publication, this vulnerability affected Cisco CSPC.
Fixed Releases
At the time of publication, the release information in the following table(s) was accurate. See the Details section in the bug ID(s) at the top of this advisory for the most complete and current information.
The left column lists Cisco software releases, and the right column indicates whether a release was affected by the vulnerability described in this advisory and which release included the fix for this vulnerability.
| Cisco CSPC Release | First Fixed Release |
|---|---|
| Earlier than 2.9.0.2 | 2.9.0.2 |
The Cisco Product Security Incident Response Team (PSIRT) validates only the affected and fixed release information that is documented in this advisory.
Duncan is a technology professional with over 20 years experience of working in various IT roles. He has a interest in cyber security, and has a wide range of other skills in radio, electronics and telecommunications.