PT-2021-17055 · Hewlett Packard · Hpe Network Orchestrator

Published 2021-03-18 · Updated 2021-03-25 · CVE-2021-26578

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions HPE Network Orchestrator (NetO) versions prior to 2.5

Description A potential security issue has been identified in HPE Network Orchestrator, which could be remotely exploited using SQL injection. This allows for information disclosure.

Recommendations For versions prior to 2.5, update to version 2.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the SQL database to minimize the risk of exploitation.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2021-26578

ZDI-21-337

Affected Products

Hpe Network Orchestrator

References · 6

• https://osv.dev/vulnerability/CVE-2021-26578 · Vendor Advisory
• https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn04097en_us · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-21-337 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-26578 · Security Note
• https://t.me/cvenotify/11973 · Telegram Post
• https://t.me/cibsecurity/25250 · Telegram Post