PT-2021-7550 · Huawei · Huawei Manageone

Published 2021-07-14 · Updated 2022-07-12 · CVE-2021-22397

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:L/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Huawei ManageOne version 8.0.0

Description The issue is related to insufficient input validation, which can be exploited to escalate privileges using specially crafted files. Attackers can exploit this by performing specific files, leading to a privilege escalation attack that can compromise normal service.

Recommendations For Huawei ManageOne version 8.0.0, consider restricting access to external parameters of files to minimize the risk of exploitation until a patch is available. As a temporary workaround, avoid using files with unverified external parameters to prevent privilege escalation attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-264

CWE-20

Related Identifiers

BDU:2022-07490

CVE-2021-22397

Affected Products

Huawei Manageone

References · 7

• https://bdu.fstec.ru/vul/2022-07490 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-22397 · Security Note
• https://huawei.com/en/psirt/security-advisories/huawei-sa-20210714-01-pe-en · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-22397 · Vendor Advisory
• https://t.me/cvenotify/19124 · Telegram Post
• https://t.me/cvenotify/18496 · Telegram Post
• https://cybersecurity-help.cz/vulnerabilities/54879 · Note