« Volver al listado

CVE-2020-9115

Estado: ModificadaAlta (7.2)—

ManageOne versions 6.5.1.1.B010, 6.5.1.1.B020, 6.5.1.1.B030, 6.5.1.1.B040, ,6.5.1.1.B050, 8.0.0 and 8.0.1 have a command injection vulnerability. An attacker with high privileges may exploit this vulnerability through some operations on the plug-in component. Due to insufficient input validation of some parameters, the attacker can exploit this vulnerability to inject commands to the target device.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Huawei — Manageone

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2020-9115",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 9,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C",
          "authentication": "SINGLE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "LOW",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.2,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.2
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@huawei.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "ManageOne",
          "versions": [
            {
              "status": "affected",
              "version": "6.5.1.1.B010,6.5.1.1.B020,6.5.1.1.B030,6.5.1.1.B040,6.5.1.1.B050,8.0.0,8.0.1"
            }
          ]
        }
      ]
    }
  ],
  "published": "2020-12-01T00:15:11.320",
  "references": [
    {
      "url": "https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20201125-01-commandinjection-en",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "psirt@huawei.com"
    },
    {
      "url": "https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20201125-01-commandinjection-en",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        },
        {
          "lang": "en",
          "value": "CWE-77"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "ManageOne versions 6.5.1.1.B010, 6.5.1.1.B020, 6.5.1.1.B030, 6.5.1.1.B040, ,6.5.1.1.B050, 8.0.0 and 8.0.1 have a command injection vulnerability. An attacker with high privileges may exploit this vulnerability through some operations on the plug-in component. Due to insufficient input validation of some parameters, the attacker can exploit this vulnerability to inject commands to the target device."
    },
    {
      "lang": "es",
      "value": "Las versiones 6.5.1.1.B010, 6.5.1.1.B020, 6.5.1.1.B030, 6.5.1.1.B040, 6.5.1.1.B050, 8.0.0 y 8.0.1 de ManageOne tienen una vulnerabilidad de inyección de comandos. Un atacante con privilegios elevados puede aprovechar esta vulnerabilidad mediante algunas operaciones en el componente plugin. Debido a una comprobación de entrada insuficiente de algunos parámetros, el atacante puede explotar  esta vulnerabilidad para inyectar comandos en el dispositivo objetivo"
    }
  ],
  "lastModified": "2026-06-17T03:27:31.400",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:huawei:manageone:6.5.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B85321E0-8B1B-452B-A1AE-D8BB85C18CE4"
            },
            {
              "criteria": "cpe:2.3:a:huawei:manageone:6.5.1.1:b010:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "463A4059-55EF-4862-B8AD-90DCAC0CC871"
            },
            {
              "criteria": "cpe:2.3:a:huawei:manageone:6.5.1.1:b020:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4042FC49-4FC7-46B4-8D14-ECACF22A9860"
            },
            {
              "criteria": "cpe:2.3:a:huawei:manageone:6.5.1.1:b030:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A4D8799F-9ADD-442F-BC39-4BCAFBFFBE2B"
            },
            {
              "criteria": "cpe:2.3:a:huawei:manageone:6.5.1.1:b040:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "535597A4-29C8-44A8-9008-4F4E10030531"
            },
            {
              "criteria": "cpe:2.3:a:huawei:manageone:6.5.1.1:b050:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2F10E645-D9C1-44F4-88DE-A8CF9ADAAF95"
            },
            {
              "criteria": "cpe:2.3:a:huawei:manageone:8.0.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4C07C03B-18BA-4EA3-A73F-3E6E839252F0"
            },
            {
              "criteria": "cpe:2.3:a:huawei:manageone:8.0.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "47A8E919-FAC0-4011-927F-599AA7688A32"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "psirt@huawei.com"
}