CVE-2021-28203

{"id": "CVE-2021-28203", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Secondary", "source": "twcert@cert.org.tw", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.2}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.2}]}, "published": "2021-04-06T05:15:16.927", "references": [{"url": "https://www.asus.com/content/ASUS-Product-Security-Advisory/", "tags": ["Vendor Advisory"], "source": "twcert@cert.org.tw"}, {"url": "https://www.asus.com/tw/support/callus/", "tags": ["Vendor Advisory"], "source": "twcert@cert.org.tw"}, {"url": "https://www.twcert.org.tw/tw/cp-132-4573-aa336-1.html", "tags": ["Third Party Advisory"], "source": "twcert@cert.org.tw"}, {"url": "https://www.asus.com/content/ASUS-Product-Security-Advisory/", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.asus.com/tw/support/callus/", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.twcert.org.tw/tw/cp-132-4573-aa336-1.html", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "twcert@cert.org.tw", "description": [{"lang": "en", "value": "CWE-78"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "The Web Set Media Image function in ASUS BMC\u2019s firmware Web management page does not filter the specific parameter. As obtaining the administrator permission, remote attackers can launch command injection to execute command arbitrary."}, {"lang": "es", "value": "La funci\u00f3n Web Set Media Image en la p\u00e1gina de administraci\u00f3n Web del firmware de ASUS BMC, no filtra el par\u00e1metro specific. Como obtener el permiso de administrador, unos atacantes remotos pueden iniciar una inyecci\u00f3n de comandos para ejecutar un comando arbitrario"}], "lastModified": "2024-11-21T05:59:21.187", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:asus:z10pr-d16_firmware:1.14.51:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F38D0E80-BD62-46A7-B1CD-6C7045FF7F79"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:asus:z10pr-d16:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "A340A0CE-8BD2-420A-814B-5585C08A4CCB"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:asus:asmb8-ikvm_firmware:1.14.51:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4D98B9CE-6675-48A4-98A3-6E5DA19A2480"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:asus:asmb8-ikvm:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "1A2F069D-18EE-49A3-A8EB-3C745425BFFE"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:asus:z10pe-d16_ws_firmware:1.14.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0B5DB0A7-B863-4AFF-BEB6-6958F921C016"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:asus:z10pe-d16_ws:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "51F61A82-6BBE-4758-9789-7CE6FCB9E20D"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "twcert@cert.org.tw"}