Lucene search

[email protected]CVE-2021-37131

HistoryOct 27, 2021 - 1:15 a.m.

CVE-2021-37131

2021-10-2701:15:07

CWE-1236

[email protected]

web.nvd.nist.gov

cve-2021-37131

csv injection

manageone

imanager neteco

imanager neteco 6000

input validation

6 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:S/C:P/I:P/A:P

6.8 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

6.5 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

42.9%

JSON

There is a CSV injection vulnerability in ManageOne, iManager NetEco and iManager NetEco 6000. An attacker with high privilege may exploit this vulnerability through some operations to inject the CSV files. Due to insufficient input validation of some parameters, the attacker can exploit this vulnerability to inject CSV files to the target device.

Affected configurations

NVD

Node

huaweimanageoneMatch6.5.1rc1.b060

huaweimanageoneMatch6.5.1rc1.b070

huaweimanageoneMatch6.5.1rc2.b020

huaweimanageoneMatch6.5.1rc2.b030

huaweimanageoneMatch6.5.1rc2.b040

huaweimanageoneMatch6.5.1rc2.b050

huaweimanageoneMatch6.5.1rc2.b060

huaweimanageoneMatch6.5.1rc2.b070

huaweimanageoneMatch6.5.1rc2.b090

huaweimanageoneMatch6.5.1.1b010

huaweimanageoneMatch6.5.1.1b020

huaweimanageoneMatch6.5.1.1b030

huaweimanageoneMatch6.5.1.1b040

huaweimanageoneMatch6.5.1.1spc100.b050

huaweimanageoneMatch6.5.1.1spc101.b010

huaweimanageoneMatch6.5.1.1spc101.b040

huaweimanageoneMatch6.5.1.1spc200

huaweimanageoneMatch6.5.1.1spc200.b010

huaweimanageoneMatch6.5.1.1spc200.b030

huaweimanageoneMatch6.5.1.1spc200.b040

huaweimanageoneMatch6.5.1.1spc200.b050

huaweimanageoneMatch6.5.1.1spc200.b060

huaweimanageoneMatch6.5.1.1spc200.b070

huaweimanageoneMatch8.0.0-

huaweimanageoneMatch8.0.0lcn080

huaweimanageoneMatch8.0.0lcnd81

huaweimanageoneMatch8.0.0rc2

huaweimanageoneMatch8.0.0rc3

huaweimanageoneMatch8.0.0spc100

huaweimanageoneMatch8.0.1

huaweiimanager_netecoMatchv600r010c00cp2001

huaweiimanager_netecoMatchv600r010c00cp2002

huaweiimanager_netecoMatchv600r010c00cp3001

huaweiimanager_netecoMatchv600r010c00cp3002

huaweiimanager_netecoMatchv600r010c00cp3101

huaweiimanager_netecoMatchv600r010c00cp3102

huaweiimanager_netecoMatchv600r010c00spc100

huaweiimanager_netecoMatchv600r010c00spc110

huaweiimanager_netecoMatchv600r010c00spc120

huaweiimanager_netecoMatchv600r010c00spc200

huaweiimanager_netecoMatchv600r010c00spc210

huaweiimanager_netecoMatchv600r010c00spc300

huaweiimanager_netecoMatchv600r010c00spc310

huaweiimanager_neteco_6000Matchv600r009c00cp2201

huaweiimanager_neteco_6000Matchv600r009c00cp2301

huaweiimanager_neteco_6000Matchv600r009c00spc100

huaweiimanager_neteco_6000Matchv600r009c00spc110

huaweiimanager_neteco_6000Matchv600r009c00spc120

huaweiimanager_neteco_6000Matchv600r009c00spc190

huaweiimanager_neteco_6000Matchv600r009c00spc200

huaweiimanager_neteco_6000Matchv600r009c00spc201

huaweiimanager_neteco_6000Matchv600r009c00spc202

huaweiimanager_neteco_6000Matchv600r009c00spc210

huaweiimanager_neteco_6000Matchv600r009c00spc220

huaweiimanager_neteco_6000Matchv600r009c00spc221

huaweiimanager_neteco_6000Matchv600r009c00spc230

huaweiimanager_neteco_6000Matchv600r009c00spc232

CPENameOperatorVersion
huawei:manageonehuawei manageoneeq6.5.1
huawei:manageonehuawei manageoneeq6.5.1.1
huawei:manageonehuawei manageoneeq8.0.0
huawei:manageonehuawei manageoneeq8.0.1
huawei:imanager_netecohuawei imanager netecoeqv600r010c00cp2001
huawei:imanager_netecohuawei imanager netecoeqv600r010c00cp2002
huawei:imanager_netecohuawei imanager netecoeqv600r010c00cp3001
huawei:imanager_netecohuawei imanager netecoeqv600r010c00cp3002
huawei:imanager_netecohuawei imanager netecoeqv600r010c00cp3101
huawei:imanager_netecohuawei imanager netecoeqv600r010c00cp3102

CPE	Name	Operator	Version
huawei:manageone	huawei manageone	eq	6.5.1
huawei:manageone	huawei manageone	eq	6.5.1.1
huawei:manageone	huawei manageone	eq	8.0.0
huawei:manageone	huawei manageone	eq	8.0.1
huawei:imanager_neteco	huawei imanager neteco	eq	v600r010c00cp2001
huawei:imanager_neteco	huawei imanager neteco	eq	v600r010c00cp2002
huawei:imanager_neteco	huawei imanager neteco	eq	v600r010c00cp3001
huawei:imanager_neteco	huawei imanager neteco	eq	v600r010c00cp3002
huawei:imanager_neteco	huawei imanager neteco	eq	v600r010c00cp3101
huawei:imanager_neteco	huawei imanager neteco	eq	v600r010c00cp3102

Rows per page:

1-10 of 311

CNA Affected

[
  {
    "product": "ManageOne;iManager NetEco;iManager NetEco 6000",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "6.5.1.1.B010,6.5.1.1.B020,6.5.1.1.B030,6.5.1.1.B040,6.5.1.SPC100.B050,6.5.1.SPC101.B010,6.5.1.SPC101.B040,6.5.1.SPC200,6.5.1.SPC200.B010,6.5.1.SPC200.B030,6.5.1.SPC200.B040,6.5.1.SPC200.B050,6.5.1.SPC200.B060,6.5.1.SPC200.B070,6.5.1RC1.B060,6.5.1RC1.B070,6.5.1RC2.B020,6.5.1RC2.B030,6.5.1RC2.B040,6.5.1RC2.B050,6.5.1RC2.B060,6.5.1RC2.B070,6.5.1RC2.B090,8.0.0,8.0.0-LCN080,8.0.0-LCND81,8.0.0.SPC100,8.0.1,8.0.RC2,8.0.RC3"
      },
      {
        "status": "affected",
        "version": "V600R010C00CP2001,V600R010C00CP2002,V600R010C00CP3001,V600R010C00CP3002,V600R010C00CP3101,V600R010C00CP3102,V600R010C00SPC100,V600R010C00SPC110,V600R010C00SPC120,V600R010C00SPC200,V600R010C00SPC210,V600R010C00SPC300,V600R010C00SPC310"
      },
      {
        "status": "affected",
        "version": "V600R009C00CP2201,V600R009C00CP2301,V600R009C00SPC100,V600R009C00SPC110,V600R009C00SPC120,V600R009C00SPC190,V600R009C00SPC200,V600R009C00SPC201,V600R009C00SPC202,V600R009C00SPC210,V600R009C00SPC220,V600R009C00SPC221,V600R009C00SPC230,V600R009C00SPC232"
      }
    ]
  }
]

References

www.huawei.com/en/psirt/security-advisories/huawei-sa-20211020-01-csv-en

6 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:S/C:P/I:P/A:P

6.8 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

6.5 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

42.9%

JSON

Related for CVE-2021-37131

huawei1 cnvd1 cvelist1 prion1 nvd1