PT-2021-16415 · Hewlett Packard · Hpe Moonshot Provisioning Manager

Published 2021-02-09 · Updated 2021-02-16 · CVE-2021-25139

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: HPE Moonshot Provisioning Manager version 1.20

Description: A potential security issue has been identified that could be remotely exploited by an unauthenticated user to cause a stack-based buffer overflow using user-supplied input to the khuploadfile.cgi CGI ELF. This could lead to Remote Code Execution, Denial of Service, and/or compromise system integrity.

Recommendations: For HPE Moonshot Provisioning Manager version 1.20, discontinue the use of the application as it is discontinued, no longer supported, and no patch is available.

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2021-25139

Affected Products

Hpe Moonshot Provisioning Manager

References · 3

• https://osv.dev/vulnerability/CVE-2021-25139 · Vendor Advisory
• https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf04084en_us · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-25139 · Security Note