Lucene search

[email protected]CVE-2021-23277

HistoryApr 13, 2021 - 7:15 p.m.

CVE-2021-23277

2021-04-1319:15:00

CWE-94

[email protected]

web.nvd.nist.gov

cve-2021-23277

eaton intelligent power manager

ipm

unauthenticated eval injection

vulnerability

nvd

security advisory

10 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

9.7 High

AI Score

Confidence

High

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.017 Low

EPSS

Percentile

87.5%

JSON

Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to unauthenticated eval injection vulnerability. The software does not neutralize code syntax from users before using in the dynamic evaluation call in loadUserFile function under scripts/libs/utils.js. Successful exploitation can allow attackers to control the input to the function and execute attacker controlled commands.

CPENameOperatorVersion
eaton:intelligent_power_managereaton intelligent power managerlt1.69
eaton:intelligent_power_manager_virtual_applianceeaton intelligent power manager virtual appliancelt1.69
eaton:intelligent_power_protectoreaton intelligent power protectorlt1.68

CPE	Name	Operator	Version
eaton:intelligent_power_manager	eaton intelligent power manager	lt	1.69
eaton:intelligent_power_manager_virtual_appliance	eaton intelligent power manager virtual appliance	lt	1.69
eaton:intelligent_power_protector	eaton intelligent power protector	lt	1.68

References

www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/eaton-intelligent-power-manager-ipm-vulnerability-advisory.pdf

Social References

10 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

9.7 High

AI Score

Confidence

High

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.017 Low

EPSS

Percentile

87.5%

JSON

Related for CVE-2021-23277

prion1 nessus1 ics1