CVE-2021-28494

In Arista's MOS (Metamako Operating System) software which is supported on the 7130 product line, under certain conditions, authentication is bypassed by unprivileged users who are accessing the Web UI. This issue affects: Arista Metamako Operating System MOS-0.34.0 and prior releases

CVSS v3 9.6 CRITICAL
CVSS v2.0 6.5 MEDIUM

9.6^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.1 / Impact : 5.8

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

6.5^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:S/C:P/I:P/A:P

Exploitability : 8.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://www.arista.com/en/support/advisories-notices/security-advisories/12916-security-advisory-68	Mitigation Vendor Advisory
https://www.arista.com/en/support/advisories-notices/security-advisories/12916-security-advisory-68	Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:arista:metamako_operating_system:*:*:*:*:*:*:*:*

cpe:2.3:h:arista:7130:-:*:*:*:*:*:*:*

History

21 Nov 2024, 05:59

Type	Values Removed	Values Added
CVSS	v2 : ~~6.5~~ v3 : ~~8.8~~	v2 : 6.5 v3 : 9.6
References	~~() https://www.arista.com/en/support/advisories-notices/security-advisories/12916-security-advisory-68 - Mitigation, Vendor Advisory~~	() https://www.arista.com/en/support/advisories-notices/security-advisories/12916-security-advisory-68 - Mitigation, Vendor Advisory

Information

Published : 2021-09-09 13:15

Updated : 2024-11-21 05:59

NVD link : CVE-2021-28494

Mitre link : CVE-2021-28494

CVE.ORG link : CVE-2021-28494

JSON object : View

Products Affected

arista

7130
metamako_operating_system

CWE

CWE-287

Improper Authentication

{"id": "CVE-2021-28494", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@arista.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.6, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 5.8, "exploitabilityScore": 3.1}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2021-09-09T13:15:09.013", "references": [{"url": "https://www.arista.com/en/support/advisories-notices/security-advisories/12916-security-advisory-68", "tags": ["Mitigation", "Vendor Advisory"], "source": "psirt@arista.com"}, {"url": "https://www.arista.com/en/support/advisories-notices/security-advisories/12916-security-advisory-68", "tags": ["Mitigation", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "psirt@arista.com", "description": [{"lang": "en", "value": "CWE-287"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-287"}]}], "descriptions": [{"lang": "en", "value": "In Arista's MOS (Metamako Operating System) software which is supported on the 7130 product line, under certain conditions, authentication is bypassed by unprivileged users who are accessing the Web UI. This issue affects: Arista Metamako Operating System MOS-0.34.0 and prior releases"}, {"lang": "es", "value": "En el software MOS (Sistema Operativo Metamako) de Arista, compatible con la l\u00ednea de productos 7130, en determinadas condiciones, la autenticaci\u00f3n es omitida por usuarios no privilegiados que acceden a la Interfaz de Usuario web. Este problema afecta a: Sistema Operativo Arista Metamako versi\u00f3n MOS-0.34.0 y versiones anteriores"}], "lastModified": "2024-11-21T05:59:46.630", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:arista:metamako_operating_system:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6C11D2B4-0389-4B23-B22A-1B0CB1B2299A", "versionEndIncluding": "0.34.0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:arista:7130:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "4D832798-DA45-4F9E-AA31-5D088253A28A"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "psirt@arista.com"}