FKIE_CVE-2021-22293

Vulnerability from fkie_nvd - Published: 2021-02-06 03:15 - Updated: 2024-11-21 05:49
Severity ?
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Summary
Some Huawei products have an inconsistent interpretation of HTTP requests vulnerability. Attackers can exploit this vulnerability to cause information leak. Affected product versions include: CampusInsight versions V100R019C10; ManageOne versions 6.5.1.1, 6.5.1.SPC100, 6.5.1.SPC200, 6.5.1RC1, 6.5.1RC2, 8.0.RC2. Affected product versions include: Taurus-AL00A versions 10.0.0.1(C00E1R1P1).
References
psirt@huawei.comhttps://www.huawei.com/en/psirt/security-advisories/huawei-sa-20210120-01-http-enVendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20210120-01-http-enVendor Advisory
Impacted products
Vendor Product Version
huawei campusinsight v100r019c10
huawei manageone 6.5.1.1
huawei manageone 6.5.1.1
huawei manageone 6.5.1.1
huawei manageone 6.5.1.1
huawei manageone 6.5.1.1
huawei manageone 8.0.0
huawei taurus-al00a_firmware 10.0.0.1\(c00e1r1p1\)
huawei taurus-al00a -
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:huawei:campusinsight:v100r019c10:*:*:*:*:*:*:*",
              "matchCriteriaId": "704AA007-5ADB-4376-BF2A-9F2B8D8E2DC8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:huawei:manageone:6.5.1.1:-:*:*:*:*:*:*",
              "matchCriteriaId": "24620D00-5935-4C33-B9E9-474353958727",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:huawei:manageone:6.5.1.1:rc1:*:*:*:*:*:*",
              "matchCriteriaId": "46A79DF7-123C-4AA9-B334-2F38FA663BED",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:huawei:manageone:6.5.1.1:rc2:*:*:*:*:*:*",
              "matchCriteriaId": "CBEB49EA-8556-49C8-80F9-682209E12D35",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:huawei:manageone:6.5.1.1:spc100:*:*:*:*:*:*",
              "matchCriteriaId": "290026C4-4A41-42E1-8729-6D682CD98E98",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:huawei:manageone:6.5.1.1:spc200:*:*:*:*:*:*",
              "matchCriteriaId": "FE5AE38A-627F-4337-949D-A5811D6859EB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:huawei:manageone:8.0.0:rc2:*:*:*:*:*:*",
              "matchCriteriaId": "51E51969-9D4D-4A58-BEBD-19F4BD64BC7A",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:huawei:taurus-al00a_firmware:10.0.0.1\\(c00e1r1p1\\):*:*:*:*:*:*:*",
              "matchCriteriaId": "1110292D-92A1-4B57-BFE6-042389ED1C2B",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:huawei:taurus-al00a:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "369D8168-4BFA-4003-A332-3E6876459623",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Some Huawei products have an inconsistent interpretation of HTTP requests vulnerability. Attackers can exploit this vulnerability to cause information leak. Affected product versions include: CampusInsight versions V100R019C10; ManageOne versions 6.5.1.1, 6.5.1.SPC100, 6.5.1.SPC200, 6.5.1RC1, 6.5.1RC2, 8.0.RC2. Affected product versions include: Taurus-AL00A versions 10.0.0.1(C00E1R1P1)."
    },
    {
      "lang": "es",
      "value": "Algunos productos de Huawei presentan una vulnerabilidad de interpretaci\u00f3n inconsistente de peticiones HTTP. Los atacantes pueden explotar esta vulnerabilidad para causar un filtrado de informaci\u00f3n. Las versiones de producto afectadas son: CampusInsight versiones V100R019C10; ManageOne versiones 6.5.1.1, 6.5.1.SPC100, 6.5.1.SPC200, 6.5.1RC1, 6.5.1RC2, 8.0.RC2. Las versiones de producto afectadas incluyen: Taurus-AL00A versi\u00f3n 10.0.0.1(C00E1R1P1)"
    }
  ],
  "id": "CVE-2021-22293",
  "lastModified": "2024-11-21T05:49:51.480",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 5.0,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "NONE",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2021-02-06T03:15:12.767",
  "references": [
    {
      "source": "psirt@huawei.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20210120-01-http-en"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20210120-01-http-en"
    }
  ],
  "sourceIdentifier": "psirt@huawei.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-444"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.