Improper input validation in Huawei Manageone
CVE-2021-22397
There is a privilege escalation vulnerability in Huawei ManageOne 8.0.0. External parameters of some files are lack of verification when they are be called. Attackers can exploit this vulnerability by performing these files to cause privilege escalation attack. This can compromise normal service.
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.7 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.002 (6.6th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 7th percentile — 6.6% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.002 · newest: 0.002 · change: 0.000
Affected products
- Huawei Manageone — versions 8.0.0
- Manageone — versions 8.0.0
Weakness classification (CWE)
References
- www.huawei.com/en/psirt/security-advisories/huawei-sa-20210714-01-pe-en (Vendor Advisory)
Frequently asked questions
- What is CVE-2021-22397?
- CVE-2021-22397 is a medium-severity vulnerability in Huawei Manageone, classified under Improper Input Validation. CVSS score: 6.7/10. Published 2021-08-02.
- How severe is CVE-2021-22397?
- Medium severity. CVSS v3 base score is 6.7 out of 10.