PT-2021-16416 · Microsoft+2 · Hyper-V+2

Published 2021-02-09 · Updated 2021-02-16 · CVE-2021-25140

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: HPE Moonshot Provisioning Manager version 1.20

Description: A potential security issue has been identified in the HPE Moonshot Provisioning Manager. This application is used to setup and configure an HPE Moonshot 1500 chassis in a VMWare or Microsoft Hyper-V environment. The issue could be remotely exploited by an unauthenticated user to cause a directory traversal in user-supplied input to the khuploadfile.cgi CGI ELF. This could lead to Remote Code Execution, Denial of Service, and/or compromise system integrity.

Recommendations: As a temporary workaround, consider disabling the khuploadfile.cgi CGI ELF until further guidance is available. HPE recommends that customers discontinue the use of the HPE Moonshot Provisioning Manager. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2021-25140

Affected Products

Hpe Moonshot Provisioning Manager

Hyper-V

Vmware

References · 4

• https://osv.dev/vulnerability/CVE-2021-25140 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-25140 · Security Note
• https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf04085en_us · Vendor Advisory
• https://t.me/cibsecurity/23316 · Telegram Post