PT-2021-15033 · Huawei · Imaster Nce-Fabric

Published 2021-11-23 · Updated 2021-11-24 · CVE-2021-22410

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: iMaster NCE-Fabric version V100R019C10

Description: The issue is related to a XSS injection vulnerability. A module of the client does not verify the input sufficiently, allowing attackers to exploit this by modifying input after logging onto the client. This may compromise the normal service of the client.

Recommendations: For iMaster NCE-Fabric version V100R019C10, consider restricting access to the client until a patch is available, and ensure that all inputs are thoroughly verified to prevent exploitation. As a temporary workaround, consider disabling the vulnerable module until a fix is provided.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-22410

Affected Products

Imaster Nce-Fabric

References · 4

• https://huawei.com/en/psirt/security-advisories/huawei-sa-20210324-01-xss-en · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-22410 · Security Note
• https://osv.dev/vulnerability/CVE-2021-22410 · Vendor Advisory
• https://t.me/cibsecurity/32847 · Telegram Post