PT-2021-14932 · Huawei · Manageone+2

Published 2021-02-06 · Updated 2021-02-10 · CVE-2021-22293

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: CampusInsight version V100R019C10 ManageOne versions 6.5.1.1, 6.5.1.SPC100, 6.5.1.SPC200, 6.5.1RC1, 6.5.1RC2, 8.0.RC2 Taurus-AL00A version 10.0.0.1(C00E1R1P1)

Description: The issue is related to an inconsistent interpretation of HTTP requests, which can be exploited by attackers to cause an information leak.

Recommendations: For CampusInsight version V100R019C10, update to a version that fixes the inconsistent interpretation of HTTP requests. For ManageOne versions 6.5.1.1, 6.5.1.SPC100, 6.5.1.SPC200, 6.5.1RC1, 6.5.1RC2, 8.0.RC2, update to a version that fixes the inconsistent interpretation of HTTP requests. For Taurus-AL00A version 10.0.0.1(C00E1R1P1), update to a version that fixes the inconsistent interpretation of HTTP requests.

Fix

HTTP Request/Response Smuggling

Weakness Enumeration

CWE-444

Related Identifiers

CVE-2021-22293

Affected Products

Campusinsight

Manageone

Taurus-Al00A

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2021-22293 · Security Note
• https://huawei.com/en/psirt/security-advisories/huawei-sa-20210120-01-http-en · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-22293 · Vendor Advisory
• https://t.me/cvenotify/9536 · Telegram Post