=====================================================================

                             CERT-Renater

                 Note d'Information No. 2021/VULN441
_____________________________________________________________________

DATE                : 07/09/2021

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Cisco Prime Infrastructure versions
                                       prior to 3.8,
                     Cisco EPN Manager versions prior to 5.0.

=====================================================================
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-prime-info-disc-nTU9FJ2
_____________________________________________________________________


Cisco Prime Infrastructure and Cisco Evolved Programmable Network
Manager Information Disclosure Vulnerability

Medium

Advisory ID:       cisco-sa-prime-info-disc-nTU9FJ2
First Published:   2021 September 1 16:00 GMT
Version 1.0:       Final
Workarounds:       No workarounds available
Cisco Bug IDs:     CSCvs07213
                   CSCvs07217
                   CSCvz12884
                   CSCvz12896
CVSS Score:        Base 5.5

CVE-2021-34733
CWE-522


Summary

    A vulnerability in the CLI of Cisco Prime Infrastructure and Cisco
Evolved Programmable Network (EPN) Manager could allow an authenticated,
local attacker to access sensitive information stored on the underlying
file system of an affected system.

    This vulnerability exists because sensitive information is not
sufficiently secured when it is stored. An attacker could exploit this
vulnerability by gaining unauthorized access to sensitive information on
an affected system. A successful exploit could allow the attacker to
create forged authentication requests and gain unauthorized access to
the affected system.

    Cisco has released software updates that address this vulnerability.
There are no workarounds that address this vulnerability.

    This advisory is available at the following link:

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-prime-info-disc-nTU9FJ2


Affected Products

    Vulnerable Products

    At the time of publication, this vulnerability affected Cisco Prime
Infrastructure releases earlier than Release 3.8 and Cisco EPN Manager
releases earlier than Release 5.0.

    See the Details section in the bug ID(s) at the top of this advisory
for the most complete and current information.


    Products Confirmed Not Vulnerable

    Only products listed in the Vulnerable Products section of this
advisory are known to be affected by this vulnerability.


Workarounds

    There are no workarounds that address this vulnerability.


Fixed Software

    When considering software upgrades, customers are advised to
regularly consult the advisories for Cisco products, which are available
from the Cisco Security Advisories page, to determine exposure and a
complete upgrade solution.

    In all cases, customers should ensure that the devices to be
upgraded contain sufficient memory and confirm that current hardware and
software configurations will continue to be supported properly by the
new release. If the information is not clear, customers are advised to
contact the Cisco Technical Assistance Center (TAC) or their contracted
maintenance providers.


    Fixed Releases

    At the time of publication, Cisco Prime Infrastructure releases 3.8
and later and Cisco EPN Manager releases 5.0 and later contained the fix
for this vulnerability.

    See the Details section in the bug ID(s) at the top of this advisory
for the most complete and current information.


Exploitation and Public Announcements

    The Cisco Product Security Incident Response Team (PSIRT) is not
aware of any public announcements or malicious use of the vulnerability
that is described in this advisory.


Source

    This vulnerability was found during internal security testing.

URL


https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-prime-info-disc-nTU9FJ2

Revision History

Version 	Description 	Section 	Status 	Date
1.0 	Initial public release. 	- 	Final 	2021-SEP-01


Legal Disclaimer

    THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY
KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF
MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE
INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT
YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS
DOCUMENT AT ANY TIME.

    A standalone copy or paraphrase of the text of this document that
omits the distribution URL is an uncontrolled copy and may lack
important information or contain factual errors. The information in this
document is intended for end users of Cisco products.



=========================================================
+ CERT-RENATER       |    tel : 01-53-94-20-44          +
+ 23/25 Rue Daviel   |    fax : 01-53-94-20-41          +
+ 75013 Paris        |    email:cert@support.renater.fr +
=========================================================