« Volver al listado

CVE-2021-29212

Estado: ModificadaCrítica (9.8)—

A remote unauthenticated directory traversal security vulnerability has been identified in HPE iLO Amplifier Pack versions 1.80, 1.81, 1.90 and 1.95. The vulnerability could be remotely exploited to allow an unauthenticated user to run arbitrary code leading complete impact to confidentiality, integrity, and availability of the iLO Amplifier Pack appliance.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

HP — ILO Amplifier Pack

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2021-29212",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 10,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "LOW",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security-alert@hpe.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "iLO Amplifier Pack",
          "versions": [
            {
              "status": "affected",
              "version": "Ver 1.80, Ver 1.81, Ver 1.90, and Ver 1.95"
            }
          ]
        }
      ]
    }
  ],
  "published": "2021-11-01T14:15:07.723",
  "references": [
    {
      "url": "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn04189en_us",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security-alert@hpe.com"
    },
    {
      "url": "https://www.zerodayinitiative.com/advisories/ZDI-21-1278/",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "security-alert@hpe.com"
    },
    {
      "url": "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn04189en_us",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.zerodayinitiative.com/advisories/ZDI-21-1278/",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A remote unauthenticated directory traversal security vulnerability has been identified in HPE iLO Amplifier Pack versions 1.80, 1.81, 1.90 and 1.95. The vulnerability could be remotely exploited to allow an unauthenticated user to run arbitrary code leading complete impact to confidentiality, integrity, and availability of the iLO Amplifier Pack appliance."
    },
    {
      "lang": "es",
      "value": "Se ha identificado una vulnerabilidad de seguridad de salto de directorio no autenticado en HPE iLO Amplifier Pack versiones 1.80, 1.81, 1.90 y 1.95. La vulnerabilidad podría ser explotada remotamente para permitir que un usuario no autenticado ejecute código arbitrario, conllevando un impacto completo en la confidencialidad, integridad y disponibilidad del dispositivo iLO Amplifier Pack"
    }
  ],
  "lastModified": "2026-06-17T03:47:24.527",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:hp:ilo_amplifier_pack:1.80:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BEAD558D-7BE0-4739-94F8-61C291273A53"
            },
            {
              "criteria": "cpe:2.3:a:hp:ilo_amplifier_pack:1.81:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DAACBE6E-9AB8-4AB1-A122-F1A6D294260C"
            },
            {
              "criteria": "cpe:2.3:a:hp:ilo_amplifier_pack:1.90:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "827C9C6D-3898-4475-8A48-D96286524162"
            },
            {
              "criteria": "cpe:2.3:a:hp:ilo_amplifier_pack:1.95:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "093DA8C2-3D32-4BFA-BF8A-E8DFADC6D6C1"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-alert@hpe.com"
}