Lucene search

K
cve[email protected]CVE-2021-37131
HistoryOct 27, 2021 - 1:15 a.m.

CVE-2021-37131

2021-10-2701:15:07
CWE-1236
web.nvd.nist.gov
28
cve-2021-37131
csv injection
manageone
imanager neteco
imanager neteco 6000
input validation

6 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:S/C:P/I:P/A:P

6.8 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

6.5 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

42.8%

There is a CSV injection vulnerability in ManageOne, iManager NetEco and iManager NetEco 6000. An attacker with high privilege may exploit this vulnerability through some operations to inject the CSV files. Due to insufficient input validation of some parameters, the attacker can exploit this vulnerability to inject CSV files to the target device.

Affected configurations

NVD
Node
huaweimanageoneMatch6.5.1rc1.b060
OR
huaweimanageoneMatch6.5.1rc1.b070
OR
huaweimanageoneMatch6.5.1rc2.b020
OR
huaweimanageoneMatch6.5.1rc2.b030
OR
huaweimanageoneMatch6.5.1rc2.b040
OR
huaweimanageoneMatch6.5.1rc2.b050
OR
huaweimanageoneMatch6.5.1rc2.b060
OR
huaweimanageoneMatch6.5.1rc2.b070
OR
huaweimanageoneMatch6.5.1rc2.b090
OR
huaweimanageoneMatch6.5.1.1b010
OR
huaweimanageoneMatch6.5.1.1b020
OR
huaweimanageoneMatch6.5.1.1b030
OR
huaweimanageoneMatch6.5.1.1b040
OR
huaweimanageoneMatch6.5.1.1spc100.b050
OR
huaweimanageoneMatch6.5.1.1spc101.b010
OR
huaweimanageoneMatch6.5.1.1spc101.b040
OR
huaweimanageoneMatch6.5.1.1spc200
OR
huaweimanageoneMatch6.5.1.1spc200.b010
OR
huaweimanageoneMatch6.5.1.1spc200.b030
OR
huaweimanageoneMatch6.5.1.1spc200.b040
OR
huaweimanageoneMatch6.5.1.1spc200.b050
OR
huaweimanageoneMatch6.5.1.1spc200.b060
OR
huaweimanageoneMatch6.5.1.1spc200.b070
OR
huaweimanageoneMatch8.0.0-
OR
huaweimanageoneMatch8.0.0lcn080
OR
huaweimanageoneMatch8.0.0lcnd81
OR
huaweimanageoneMatch8.0.0rc2
OR
huaweimanageoneMatch8.0.0rc3
OR
huaweimanageoneMatch8.0.0spc100
OR
huaweimanageoneMatch8.0.1
OR
huaweiimanager_netecoMatchv600r010c00cp2001
OR
huaweiimanager_netecoMatchv600r010c00cp2002
OR
huaweiimanager_netecoMatchv600r010c00cp3001
OR
huaweiimanager_netecoMatchv600r010c00cp3002
OR
huaweiimanager_netecoMatchv600r010c00cp3101
OR
huaweiimanager_netecoMatchv600r010c00cp3102
OR
huaweiimanager_netecoMatchv600r010c00spc100
OR
huaweiimanager_netecoMatchv600r010c00spc110
OR
huaweiimanager_netecoMatchv600r010c00spc120
OR
huaweiimanager_netecoMatchv600r010c00spc200
OR
huaweiimanager_netecoMatchv600r010c00spc210
OR
huaweiimanager_netecoMatchv600r010c00spc300
OR
huaweiimanager_netecoMatchv600r010c00spc310
OR
huaweiimanager_neteco_6000Matchv600r009c00cp2201
OR
huaweiimanager_neteco_6000Matchv600r009c00cp2301
OR
huaweiimanager_neteco_6000Matchv600r009c00spc100
OR
huaweiimanager_neteco_6000Matchv600r009c00spc110
OR
huaweiimanager_neteco_6000Matchv600r009c00spc120
OR
huaweiimanager_neteco_6000Matchv600r009c00spc190
OR
huaweiimanager_neteco_6000Matchv600r009c00spc200
OR
huaweiimanager_neteco_6000Matchv600r009c00spc201
OR
huaweiimanager_neteco_6000Matchv600r009c00spc202
OR
huaweiimanager_neteco_6000Matchv600r009c00spc210
OR
huaweiimanager_neteco_6000Matchv600r009c00spc220
OR
huaweiimanager_neteco_6000Matchv600r009c00spc221
OR
huaweiimanager_neteco_6000Matchv600r009c00spc230
OR
huaweiimanager_neteco_6000Matchv600r009c00spc232

CNA Affected

[
  {
    "product": "ManageOne;iManager NetEco;iManager NetEco 6000",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "6.5.1.1.B010,6.5.1.1.B020,6.5.1.1.B030,6.5.1.1.B040,6.5.1.SPC100.B050,6.5.1.SPC101.B010,6.5.1.SPC101.B040,6.5.1.SPC200,6.5.1.SPC200.B010,6.5.1.SPC200.B030,6.5.1.SPC200.B040,6.5.1.SPC200.B050,6.5.1.SPC200.B060,6.5.1.SPC200.B070,6.5.1RC1.B060,6.5.1RC1.B070,6.5.1RC2.B020,6.5.1RC2.B030,6.5.1RC2.B040,6.5.1RC2.B050,6.5.1RC2.B060,6.5.1RC2.B070,6.5.1RC2.B090,8.0.0,8.0.0-LCN080,8.0.0-LCND81,8.0.0.SPC100,8.0.1,8.0.RC2,8.0.RC3"
      },
      {
        "status": "affected",
        "version": "V600R010C00CP2001,V600R010C00CP2002,V600R010C00CP3001,V600R010C00CP3002,V600R010C00CP3101,V600R010C00CP3102,V600R010C00SPC100,V600R010C00SPC110,V600R010C00SPC120,V600R010C00SPC200,V600R010C00SPC210,V600R010C00SPC300,V600R010C00SPC310"
      },
      {
        "status": "affected",
        "version": "V600R009C00CP2201,V600R009C00CP2301,V600R009C00SPC100,V600R009C00SPC110,V600R009C00SPC120,V600R009C00SPC190,V600R009C00SPC200,V600R009C00SPC201,V600R009C00SPC202,V600R009C00SPC210,V600R009C00SPC220,V600R009C00SPC221,V600R009C00SPC230,V600R009C00SPC232"
      }
    ]
  }
]

6 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:S/C:P/I:P/A:P

6.8 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

6.5 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

42.8%

Related for CVE-2021-37131