Lucene search

[email protected]CVE-2021-23279

HistoryApr 13, 2021 - 7:15 p.m.

CVE-2021-23279

2021-04-1319:15:00

CWE-20

[email protected]

web.nvd.nist.gov

eaton

ipm

cve-2021-23279

vulnerability

unauthenticated

file delete

input validation

meta_driver_srv.js

10 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H

9.4 High

AI Score

Confidence

High

6.4 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:P/A:P

0.001 Low

EPSS

Percentile

41.9%

JSON

Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to unauthenticated arbitrary file delete vulnerability induced due to improper input validation in meta_driver_srv.js class with saveDriverData action using invalidated driverID. An attacker can send specially crafted packets to delete the files on the system where IPM software is installed.

CPENameOperatorVersion
eaton:intelligent_power_managereaton intelligent power managerlt1.69
eaton:intelligent_power_manager_virtual_applianceeaton intelligent power manager virtual appliancelt1.69
eaton:intelligent_power_protectoreaton intelligent power protectorlt1.68

CPE	Name	Operator	Version
eaton:intelligent_power_manager	eaton intelligent power manager	lt	1.69
eaton:intelligent_power_manager_virtual_appliance	eaton intelligent power manager virtual appliance	lt	1.69
eaton:intelligent_power_protector	eaton intelligent power protector	lt	1.68

References

www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/eaton-intelligent-power-manager-ipm-vulnerability-advisory.pdf

Social References

10 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H

9.4 High

AI Score

Confidence

High

6.4 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:P/A:P

0.001 Low

EPSS

Percentile

41.9%

JSON

Related for CVE-2021-23279

prion1 nessus1 ics1