« Volver al listado

CVE-2021-37106

Estado: ModificadaAlta (7.2)—

There is a command injection vulnerability in CMA service module of FusionCompute 6.3.0, 6.3.1, 6.5.0 and 8.0.0 when processing the default certificate file. The software constructs part of a command using external special input from users, but the software does not sufficiently validate the user input. Successful exploit could allow the attacker to inject certain commands to the system.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Huawei — Fusioncompute

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2021-37106",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 9,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C",
          "authentication": "SINGLE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "LOW",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.2,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.2
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@huawei.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "FusionCompute",
          "versions": [
            {
              "status": "affected",
              "version": "6.3.0,6.3.1,6.5.0,8.0.0"
            }
          ]
        }
      ]
    }
  ],
  "published": "2021-09-28T15:15:07.503",
  "references": [
    {
      "url": "https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20210922-01-commandinjection-en",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "psirt@huawei.com"
    },
    {
      "url": "https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20210922-01-commandinjection-en",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-77"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "There is a command injection vulnerability in CMA service module of FusionCompute 6.3.0, 6.3.1, 6.5.0 and 8.0.0 when processing the default certificate file. The software constructs part of a command using external special input from users, but the software does not sufficiently validate the user input. Successful exploit could allow the attacker to inject certain commands to the system."
    },
    {
      "lang": "es",
      "value": "Se presenta una vulnerabilidad de inyección de comandos en el módulo de servicio CMA de FusionCompute versiones 6.3.0, 6.3.1, 6.5.0 y 8.0.0 cuando se procesa el archivo de certificado predeterminado. El software construye parte de un comando usando una entrada especial externa de los usuarios, pero el software no comprueba suficientemente la entrada del usuario. Una explotación con éxito podría permitir al atacante inyectar determinados comandos en el sistema"
    }
  ],
  "lastModified": "2026-06-17T03:59:58.907",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:huawei:fusioncompute:6.3.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "319C5290-36D1-4A96-80D3-18978161557D"
            },
            {
              "criteria": "cpe:2.3:a:huawei:fusioncompute:6.3.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9EFA1D96-F198-4424-8F5A-1C7DFF3F42AE"
            },
            {
              "criteria": "cpe:2.3:a:huawei:fusioncompute:6.5.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EB149F98-77DF-40C3-A307-21D7B9BCB6DA"
            },
            {
              "criteria": "cpe:2.3:a:huawei:fusioncompute:8.0.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5D251AD0-6227-4190-815F-B526F40D8A43"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "psirt@huawei.com"
}