Lucene search

[email protected]CVE-2021-37105

HistorySep 28, 2021 - 3:15 p.m.

CVE-2021-37105

2021-09-2815:15:07

CWE-434

[email protected]

web.nvd.nist.gov

cve-2021-37105

improper file upload

fusioncompute

vulnerability

file access path

verification

security

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:N/A:P

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

7.5 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

38.9%

JSON

There is an improper file upload control vulnerability in FusionCompute 6.5.0, 6.5.1 and 8.0.0. Due to the improper verification of file to be uploaded and does not strictly restrict the file access path, attackers may upload malicious files to the device, resulting in the service abnormal.

Affected configurations

NVD

Node

huaweifusioncomputeMatch6.5.0

huaweifusioncomputeMatch6.5.1

huaweifusioncomputeMatch8.0.0

CPENameOperatorVersion
huawei:fusioncomputehuawei fusioncomputeeq6.5.0
huawei:fusioncomputehuawei fusioncomputeeq6.5.1
huawei:fusioncomputehuawei fusioncomputeeq8.0.0

CPE	Name	Operator	Version
huawei:fusioncompute	huawei fusioncompute	eq	6.5.0
huawei:fusioncompute	huawei fusioncompute	eq	6.5.1
huawei:fusioncompute	huawei fusioncompute	eq	8.0.0

CNA Affected

[
  {
    "product": "FusionCompute",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "6.5.0,6.5.1,8.0.0"
      }
    ]
  }
]

References

www.huawei.com/en/psirt/security-advisories/huawei-sa-20210922-01-upload-en

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:N/A:P

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

7.5 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

38.9%

JSON

Related for CVE-2021-37105

prion1 nvd1 huawei1 cvelist1