« Volver al listado

CVE-2021-29218

Estado: ModificadaMedia (6.7)—

A local unquoted search path security vulnerability has been identified in HPE Agentless Management Service for Windows version(s): Prior to 1.44.0.0, 10.96.0.0. This vulnerability could be exploited locally by a user with high privileges to execute malware that may lead to a loss of confidentiality, integrity, and availability. HPE has provided software updates to resolve the vulnerability in HPE Agentless Management Service for Windows.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

HPE — Agentless ManagementHPE — Proliant Agentless Management

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2021-29218",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.6,
          "accessVector": "LOCAL",
          "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 3.9,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.7,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 0.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-alert@hpe.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "HPE Agentless Management",
          "versions": [
            {
              "status": "affected",
              "version": "Prior to 1.44.0.0, 10.96.0.0"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-02-04T23:15:11.407",
  "references": [
    {
      "url": "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn04233en_us",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security-alert@hpe.com"
    },
    {
      "url": "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn04233en_us",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-428"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A local unquoted search path security vulnerability has been identified in HPE Agentless Management Service for Windows version(s): Prior to 1.44.0.0, 10.96.0.0. This vulnerability could be exploited locally by a user with high privileges to execute malware that may lead to a loss of confidentiality, integrity, and availability. HPE has provided software updates to resolve the vulnerability in HPE Agentless Management Service for Windows."
    },
    {
      "lang": "es",
      "value": "Se ha identificado una vulnerabilidad de seguridad en la ruta de búsqueda local no citada en  HPE Agentless Management Service para Windows versiones: Anteriores a 1.44.0.0, 10.96.0.0. Esta vulnerabilidad podría ser explotada localmente por un usuario con altos privilegios para ejecutar malware que puede conllevar a una pérdida de confidencialidad, integridad y disponibilidad. HPE ha proporcionado actualizaciones de software para resolver la vulnerabilidad en HPE Agentless Management Service para Windows"
    }
  ],
  "lastModified": "2026-06-17T03:47:25.180",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:hpe:agentless_management:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F51AF901-3141-438F-AFA6-2BB6A1517D96",
              "versionEndExcluding": "1.44.0.0"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:x64:*",
              "vulnerable": false,
              "matchCriteriaId": "82132539-3C34-4B63-BE2A-F51077D8BC5A"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:hpe:proliant_agentless_management:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D67AC01D-71F2-4814-BFA2-28DD526A4A6E",
              "versionEndExcluding": "10.96.0.0"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:hpe:apollo_20:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "CCF1FAB2-B69D-403F-9CE3-1F08000168ED"
            },
            {
              "criteria": "cpe:2.3:h:hpe:apollo_2000_gen_10_plus:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "C3696F8B-6433-4E1E-83F1-0F385F7AE819"
            },
            {
              "criteria": "cpe:2.3:h:hpe:apollo_6500:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "BE45FAEB-6FFB-418F-BD19-C8859B92B399"
            },
            {
              "criteria": "cpe:2.3:h:hpe:apollo_6500_gen10_plus:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "970779A7-00C5-4A06-89B1-717418934EAA"
            },
            {
              "criteria": "cpe:2.3:h:hpe:apollo_80:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "FB96A78D-9DEE-4156-B6B0-3C64BBA2A7AA"
            },
            {
              "criteria": "cpe:2.3:h:hpe:proliant_dl:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "00820B28-509B-4D6E-8F7F-FC793198FA5F"
            },
            {
              "criteria": "cpe:2.3:h:hpe:proliant_ml:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "8B7DAFFA-24F6-4E3E-9152-668029351953"
            },
            {
              "criteria": "cpe:2.3:h:hpe:synergy_480_gen9:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "86B14DA3-004D-423F-ACF6-CA8045D20DB6"
            },
            {
              "criteria": "cpe:2.3:h:hpe:synergy_620_gen9:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "1B597367-C014-40FD-9BBB-CBE6A6D164EE"
            },
            {
              "criteria": "cpe:2.3:h:hpe:synergy_660_gen9:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "81F08AE0-095E-4A0B-BE4E-5BF1CFAA1920"
            },
            {
              "criteria": "cpe:2.3:h:hpe:synergy_680_gen9:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "467A5F6C-5E1E-443E-9D11-8F2F094BAA2E"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "security-alert@hpe.com"
}