CVE-2021-1499 is an unauthenticated file upload vulnerability in the web-based management interface of Cisco HyperFlex HX Data Platform, affecting various HX220c and HX240c models. This medium-severity vulnerability (CVSS 5.3) allows a remote attacker to upload files with tomcat8 user permissions due to missing authentication in the upload function. While not currently on the CISA KEV catalog, exploit modules are publicly available, including a Metasploit module for remote code execution and Nuclei templates for arbitrary file upload. Despite the availability of exploit code, there is minimal community discussion or media coverage surrounding this CVE.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 4.0\(2e\)CPE matchmatch criteria | cpe:2.3:o:cisco:hyperflex_hx_data_platform:*:*:*:*:*:*:*:* | ||
>= 4.5, < 4.5\(2a\)CPE matchmatch criteria | cpe:2.3:o:cisco:hyperflex_hx_data_platform:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.