Lucene search

HuaweiCVE-2021-37131

HistoryOct 27, 2021 - 1:15 a.m.

CVE-2021-37131

2021-10-2701:15:07

CWE-1236

huawei

web.nvd.nist.gov

cve-2021-37131

csv injection

manageone

imanager neteco

imanager neteco 6000

input validation

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:S/C:P/I:P/A:P

CVSS3

6.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

AI Score

6.5

Confidence

High

EPSS

0.001

Percentile

42.8%

JSON

There is a CSV injection vulnerability in ManageOne, iManager NetEco and iManager NetEco 6000. An attacker with high privilege may exploit this vulnerability through some operations to inject the CSV files. Due to insufficient input validation of some parameters, the attacker can exploit this vulnerability to inject CSV files to the target device.

Affected configurations

Nvd

Vulners

Node

huaweimanageoneMatch6.5.1rc1.b060

huaweimanageoneMatch6.5.1rc1.b070

huaweimanageoneMatch6.5.1rc2.b020

huaweimanageoneMatch6.5.1rc2.b030

huaweimanageoneMatch6.5.1rc2.b040

huaweimanageoneMatch6.5.1rc2.b050

huaweimanageoneMatch6.5.1rc2.b060

huaweimanageoneMatch6.5.1rc2.b070

huaweimanageoneMatch6.5.1rc2.b090

huaweimanageoneMatch6.5.1.1b010

huaweimanageoneMatch6.5.1.1b020

huaweimanageoneMatch6.5.1.1b030

huaweimanageoneMatch6.5.1.1b040

huaweimanageoneMatch6.5.1.1spc100.b050

huaweimanageoneMatch6.5.1.1spc101.b010

huaweimanageoneMatch6.5.1.1spc101.b040

huaweimanageoneMatch6.5.1.1spc200

huaweimanageoneMatch6.5.1.1spc200.b010

huaweimanageoneMatch6.5.1.1spc200.b030

huaweimanageoneMatch6.5.1.1spc200.b040

huaweimanageoneMatch6.5.1.1spc200.b050

huaweimanageoneMatch6.5.1.1spc200.b060

huaweimanageoneMatch6.5.1.1spc200.b070

huaweimanageoneMatch8.0.0-

huaweimanageoneMatch8.0.0lcn080

huaweimanageoneMatch8.0.0lcnd81

huaweimanageoneMatch8.0.0rc2

huaweimanageoneMatch8.0.0rc3

huaweimanageoneMatch8.0.0spc100

huaweimanageoneMatch8.0.1

huaweiimanager_netecoMatchv600r010c00cp2001

huaweiimanager_netecoMatchv600r010c00cp2002

huaweiimanager_netecoMatchv600r010c00cp3001

huaweiimanager_netecoMatchv600r010c00cp3002

huaweiimanager_netecoMatchv600r010c00cp3101

huaweiimanager_netecoMatchv600r010c00cp3102

huaweiimanager_netecoMatchv600r010c00spc100

huaweiimanager_netecoMatchv600r010c00spc110

huaweiimanager_netecoMatchv600r010c00spc120

huaweiimanager_netecoMatchv600r010c00spc200

huaweiimanager_netecoMatchv600r010c00spc210

huaweiimanager_netecoMatchv600r010c00spc300

huaweiimanager_netecoMatchv600r010c00spc310

huaweiimanager_neteco_6000Matchv600r009c00cp2201

huaweiimanager_neteco_6000Matchv600r009c00cp2301

huaweiimanager_neteco_6000Matchv600r009c00spc100

huaweiimanager_neteco_6000Matchv600r009c00spc110

huaweiimanager_neteco_6000Matchv600r009c00spc120

huaweiimanager_neteco_6000Matchv600r009c00spc190

huaweiimanager_neteco_6000Matchv600r009c00spc200

huaweiimanager_neteco_6000Matchv600r009c00spc201

huaweiimanager_neteco_6000Matchv600r009c00spc202

huaweiimanager_neteco_6000Matchv600r009c00spc210

huaweiimanager_neteco_6000Matchv600r009c00spc220

huaweiimanager_neteco_6000Matchv600r009c00spc221

huaweiimanager_neteco_6000Matchv600r009c00spc230

huaweiimanager_neteco_6000Matchv600r009c00spc232

VendorProductVersionCPE
huaweimanageone6.5.1cpe:2.3:a:huawei:manageone:6.5.1:rc1.b060:*:*:*:*:*:*
huaweimanageone6.5.1cpe:2.3:a:huawei:manageone:6.5.1:rc1.b070:*:*:*:*:*:*
huaweimanageone6.5.1cpe:2.3:a:huawei:manageone:6.5.1:rc2.b020:*:*:*:*:*:*
huaweimanageone6.5.1cpe:2.3:a:huawei:manageone:6.5.1:rc2.b030:*:*:*:*:*:*
huaweimanageone6.5.1cpe:2.3:a:huawei:manageone:6.5.1:rc2.b040:*:*:*:*:*:*
huaweimanageone6.5.1cpe:2.3:a:huawei:manageone:6.5.1:rc2.b050:*:*:*:*:*:*
huaweimanageone6.5.1cpe:2.3:a:huawei:manageone:6.5.1:rc2.b060:*:*:*:*:*:*
huaweimanageone6.5.1cpe:2.3:a:huawei:manageone:6.5.1:rc2.b070:*:*:*:*:*:*
huaweimanageone6.5.1cpe:2.3:a:huawei:manageone:6.5.1:rc2.b090:*:*:*:*:*:*
huaweimanageone6.5.1.1cpe:2.3:a:huawei:manageone:6.5.1.1:b010:*:*:*:*:*:*

Vendor	Product	Version	CPE
huawei	manageone	6.5.1	cpe:2.3:a:huawei:manageone:6.5.1:rc1.b060::::::
huawei	manageone	6.5.1	cpe:2.3:a:huawei:manageone:6.5.1:rc1.b070::::::
huawei	manageone	6.5.1	cpe:2.3:a:huawei:manageone:6.5.1:rc2.b020::::::
huawei	manageone	6.5.1	cpe:2.3:a:huawei:manageone:6.5.1:rc2.b030::::::
huawei	manageone	6.5.1	cpe:2.3:a:huawei:manageone:6.5.1:rc2.b040::::::
huawei	manageone	6.5.1	cpe:2.3:a:huawei:manageone:6.5.1:rc2.b050::::::
huawei	manageone	6.5.1	cpe:2.3:a:huawei:manageone:6.5.1:rc2.b060::::::
huawei	manageone	6.5.1	cpe:2.3:a:huawei:manageone:6.5.1:rc2.b070::::::
huawei	manageone	6.5.1	cpe:2.3:a:huawei:manageone:6.5.1:rc2.b090::::::
huawei	manageone	6.5.1.1	cpe:2.3:a:huawei:manageone:6.5.1.1:b010::::::

Rows per page:

1-10 of 571

CNA Affected

[
  {
    "product": "ManageOne;iManager NetEco;iManager NetEco 6000",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "6.5.1.1.B010,6.5.1.1.B020,6.5.1.1.B030,6.5.1.1.B040,6.5.1.SPC100.B050,6.5.1.SPC101.B010,6.5.1.SPC101.B040,6.5.1.SPC200,6.5.1.SPC200.B010,6.5.1.SPC200.B030,6.5.1.SPC200.B040,6.5.1.SPC200.B050,6.5.1.SPC200.B060,6.5.1.SPC200.B070,6.5.1RC1.B060,6.5.1RC1.B070,6.5.1RC2.B020,6.5.1RC2.B030,6.5.1RC2.B040,6.5.1RC2.B050,6.5.1RC2.B060,6.5.1RC2.B070,6.5.1RC2.B090,8.0.0,8.0.0-LCN080,8.0.0-LCND81,8.0.0.SPC100,8.0.1,8.0.RC2,8.0.RC3"
      },
      {
        "status": "affected",
        "version": "V600R010C00CP2001,V600R010C00CP2002,V600R010C00CP3001,V600R010C00CP3002,V600R010C00CP3101,V600R010C00CP3102,V600R010C00SPC100,V600R010C00SPC110,V600R010C00SPC120,V600R010C00SPC200,V600R010C00SPC210,V600R010C00SPC300,V600R010C00SPC310"
      },
      {
        "status": "affected",
        "version": "V600R009C00CP2201,V600R009C00CP2301,V600R009C00SPC100,V600R009C00SPC110,V600R009C00SPC120,V600R009C00SPC190,V600R009C00SPC200,V600R009C00SPC201,V600R009C00SPC202,V600R009C00SPC210,V600R009C00SPC220,V600R009C00SPC221,V600R009C00SPC230,V600R009C00SPC232"
      }
    ]
  }
]

References

www.huawei.com/en/psirt/security-advisories/huawei-sa-20211020-01-csv-en

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:S/C:P/I:P/A:P

CVSS3

6.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

AI Score

6.5

Confidence

High

EPSS

0.001

Percentile

42.8%

JSON

Related for CVE-2021-37131