Cisco Application Policy Infrastructure Controller and Cisco Cloud Network Controller Cross-Site Request Forgery Vulnerability

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• cisco application policy infrastructure controller4.2\(6\) and later · before 5.2\(7g\)
• cisco application policy infrastructure controller6.0 and later · before 6.0\(2h\)
• cisco cloud network controller4.2\(6\) and later · before 25.0\(5\)

Versions reported by the vendor

Affected version ranges reported by the assigning authority (cisco). Independent of NVD's CPE analysis and usually ahead of it.

• Cisco Cisco Application Policy Infrastructure Controller (APIC)

  • n/aaffected

Other highest-scoring records for the same primary product.

• CVE-2021-1581Cisco Application Policy Infrastructure Controller Command Injection and File Upload Vulnerabilities
  36Monitor
• CVE-2021-1579Cisco Application Policy Infrastructure Controller App Privilege Escalation Vulnerability
  36Monitor
• CVE-2021-1578Cisco Application Policy Infrastructure Controller Privilege Escalation Vulnerability
  36Monitor
• CVE-2021-1577Cisco Application Policy Infrastructure Controller Arbitrary File Read and Write Vulnerability
  36Monitor
• CVE-2019-1682Cisco Application Policy Infrastructure Controller Privilege Escalation Vulnerability
  31Monitor
• CVE-2017-6768A vulnerability in the build procedure for certain executable system files installed at boot time on Cisco Application Policy Infrastructure
  31Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

State-changing requests rely on the session cookie the browser sends automatically; nothing verifies that the request came from the user’s own page.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1app.use(session({ cookie: { httpOnly: true } }));2app.post("/account/address", updateAddress);

1app.use(session({ cookie: { httpOnly: true, sameSite: "lax" } }));2app.post("/account/address", csrfProtection, updateAddress);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.