CVE-2021-23278

🗓️ 13 Apr 2021 18:02:51Reported by EatonType

cve🔗 web.nvd.nist.gov📰️ 4 Media mentions👁 62 Views🌐 WEB

Eaton IPM < 1.69 authenticated arbitrary file delete vulnerabilit

Reporter	Title	Published	Views	Family All 9
CNNVD	Eaton Intelligent Power Manager 输入验证错误漏洞	13 Apr 202100:00	–	cnnvd
CNVD	Eaton Intelligent Power Manager Arbitrary File Deletion Vulnerability (CNVD-2021-31672)	19 Apr 202100:00	–	cnvd
Check Point Advisories	Eaton IPM Arbitrary File Deletion (CVE-2021-23278)	29 Sep 202100:00	–	checkpoint_advisories
Cvelist	CVE-2021-23278 Arbitrary File delete	13 Apr 202118:02	–	cvelist
Tenable Nessus	Eaton Intelligent Power Manager (IPM) < 1.69 Multiple Vulnerabilities (ETN-VA-2021-1000)	29 Apr 202100:00	–	nessus
EUVD	EUVD-2021-10373	7 Oct 202500:30	–	euvd
ICS	Eaton Intelligent Power Manager	20 Apr 202100:00	–	ics
NVD	CVE-2021-23278	13 Apr 202119:15	–	nvd
Prion	Input validation	13 Apr 202119:15	–	prion

NVD

Node

eaton intelligent_power_managerRange<1.69

eaton intelligent_power_manager_virtual_applianceRange<1.69

eaton intelligent_power_protectorRange<1.68

[
  {
    "product": "Intelligent Power manager (IPM)",
    "vendor": "Eaton",
    "versions": [
      {
        "lessThan": "1.69",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
eaton	www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/eaton-intelligent-power-manager-ipm-vulnerability-advisory.pdf

Parameter	Position	Path	Description	CWE
action	query param	server/maps_srv.js	Authenticated arbitrary file delete via removeBackground action in maps_srv.js	CWE-20
action	query param	server/node_upgrade_srv.js	Authenticated arbitrary file delete via removeFirmware action in node_upgrade_srv.js	CWE-20

21 Nov 2024 05:51Current

9High risk

Vulners AI Score9

CVSS 25.5

CVSS 3.18.7 - 9.6

EPSS0.00123

CWE-20