cnvd - cnvd-2021-36267

cnvd-2021-36267

Vulnerability from cnvd

Title: ASUS BMC Firmware路径遍历漏洞（CNVD-2021-36267）

Description:

ASUS BMC Firmware是中国华硕（ASUS）公司的一个固件。

ASUS BMC Firmware Web management page存在路径遍历漏洞，该漏洞源于Delete SOL video file function不过滤具体参数。远程攻击者可利用该漏洞在获得管理员权限后，可以通过路径遍历的方式访问系统文件。

Severity: 中

Patch Name: ASUS BMC Firmware路径遍历漏洞（CNVD-2021-36267）的补丁

Patch Description:

ASUS BMC Firmware是中国华硕（ASUS）公司的一个固件。

ASUS BMC Firmware Web management page存在路径遍历漏洞，该漏洞源于Delete SOL video file function不过滤具体参数。远程攻击者可利用该漏洞在获得管理员权限后，可以通过路径遍历的方式访问系统文件。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description:

目前厂商已发布升级补丁以修复漏洞，补丁获取链接： https://www.asus.com/content/ASUS-Product-Security-Advisory/

Reference: https://www.asus.com/tw/support/callus/

Impacted products

Name
ASUS BMC Firmware

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2021-28205"
    }
  },
  "description": "ASUS BMC Firmware\u662f\u4e2d\u56fd\u534e\u7855\uff08ASUS\uff09\u516c\u53f8\u7684\u4e00\u4e2a\u56fa\u4ef6\u3002\n\nASUS BMC Firmware Web management page\u5b58\u5728\u8def\u5f84\u904d\u5386\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8eDelete SOL video file function\u4e0d\u8fc7\u6ee4\u5177\u4f53\u53c2\u6570\u3002\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5728\u83b7\u5f97\u7ba1\u7406\u5458\u6743\u9650\u540e\uff0c\u53ef\u4ee5\u901a\u8fc7\u8def\u5f84\u904d\u5386\u7684\u65b9\u5f0f\u8bbf\u95ee\u7cfb\u7edf\u6587\u4ef6\u3002",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6f0f\u6d1e\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1a\r\nhttps://www.asus.com/content/ASUS-Product-Security-Advisory/",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2021-36267",
  "openTime": "2021-05-21",
  "patchDescription": "ASUS BMC Firmware\u662f\u4e2d\u56fd\u534e\u7855\uff08ASUS\uff09\u516c\u53f8\u7684\u4e00\u4e2a\u56fa\u4ef6\u3002\r\n\r\nASUS BMC Firmware Web management page\u5b58\u5728\u8def\u5f84\u904d\u5386\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8eDelete SOL video file function\u4e0d\u8fc7\u6ee4\u5177\u4f53\u53c2\u6570\u3002\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5728\u83b7\u5f97\u7ba1\u7406\u5458\u6743\u9650\u540e\uff0c\u53ef\u4ee5\u901a\u8fc7\u8def\u5f84\u904d\u5386\u7684\u65b9\u5f0f\u8bbf\u95ee\u7cfb\u7edf\u6587\u4ef6\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "ASUS BMC Firmware\u8def\u5f84\u904d\u5386\u6f0f\u6d1e\uff08CNVD-2021-36267\uff09\u7684\u8865\u4e01",
  "products": {
    "product": "ASUS BMC Firmware"
  },
  "referenceLink": "https://www.asus.com/tw/support/callus/",
  "serverity": "\u4e2d",
  "submitTime": "2021-04-08",
  "title": "ASUS BMC Firmware\u8def\u5f84\u904d\u5386\u6f0f\u6d1e\uff08CNVD-2021-36267\uff09"
}

CVE-2021-28205 (GCVE-0-2021-28205)

Vulnerability from cvelistv5

Published

2021-04-06 05:02

Modified

2024-09-17 02:21

Severity ?

4.9 (Medium) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Summary

The specific function in ASUS BMC’s firmware Web management page (Delete SOL video file function) does not filter the specific parameter. As obtaining the administrator permission, remote attackers can use the means of path traversal to access system files.

References

▼	URL	Tags
	https://www.asus.com/content/ASUS-Product-Security-Advisory/	x_refsource_MISC
	https://www.asus.com/tw/support/callus/	x_refsource_MISC
	https://www.twcert.org.tw/tw/cp-132-4575-2e32d-1.html	x_refsource_MISC

Impacted products

Vendor

Product

Version

▼

ASUS

BMC firmware for Z10PR-D16

Version: 1.14.51

	ASUS	BMC firmware for ASMB8-iKVM	Version: 1.14.51
	ASUS	BMC firmware for Z10PE-D16 WS	Version: 1.14.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T21:40:13.302Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.asus.com/content/ASUS-Product-Security-Advisory/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.asus.com/tw/support/callus/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.twcert.org.tw/tw/cp-132-4575-2e32d-1.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "BMC firmware for Z10PR-D16",
          "vendor": "ASUS",
          "versions": [
            {
              "status": "affected",
              "version": "1.14.51"
            }
          ]
        },
        {
          "product": "BMC firmware for ASMB8-iKVM",
          "vendor": "ASUS",
          "versions": [
            {
              "status": "affected",
              "version": "1.14.51"
            }
          ]
        },
        {
          "product": "BMC firmware for Z10PE-D16 WS",
          "vendor": "ASUS",
          "versions": [
            {
              "status": "affected",
              "version": "1.14.2"
            }
          ]
        }
      ],
      "datePublic": "2021-04-06T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "The specific function in ASUS BMC\u2019s firmware Web management page (Delete SOL video file function) does not filter the specific parameter. As obtaining the administrator permission, remote attackers can use the means of path traversal to access system files."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-04-06T05:02:22",
        "orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
        "shortName": "twcert"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.asus.com/content/ASUS-Product-Security-Advisory/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.asus.com/tw/support/callus/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.twcert.org.tw/tw/cp-132-4575-2e32d-1.html"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "update BMC\u0027s firmwares to the following versions:\nZ10PR-D16 1.16.1\nASMB8-iKVM 1.16.1\nZ10PE-D16 WS 1.16.1"
        }
      ],
      "source": {
        "advisory": "TVN-202103032",
        "discovery": "EXTERNAL"
      },
      "title": "ASUS BMC\u0027s firmware: path traversal - Delete SOL video file function",
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "AKA": "TWCERT/CC",
          "ASSIGNER": "cve@cert.org.tw",
          "DATE_PUBLIC": "2021-04-06T02:48:00.000Z",
          "ID": "CVE-2021-28205",
          "STATE": "PUBLIC",
          "TITLE": "ASUS BMC\u0027s firmware: path traversal - Delete SOL video file function"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "BMC firmware for Z10PR-D16",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "1.14.51"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "BMC firmware for ASMB8-iKVM",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "1.14.51"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "BMC firmware for Z10PE-D16 WS",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "1.14.2"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "ASUS"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The specific function in ASUS BMC\u2019s firmware Web management page (Delete SOL video file function) does not filter the specific parameter. As obtaining the administrator permission, remote attackers can use the means of path traversal to access system files."
            }
          ]
        },
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.asus.com/content/ASUS-Product-Security-Advisory/",
              "refsource": "MISC",
              "url": "https://www.asus.com/content/ASUS-Product-Security-Advisory/"
            },
            {
              "name": "https://www.asus.com/tw/support/callus/",
              "refsource": "MISC",
              "url": "https://www.asus.com/tw/support/callus/"
            },
            {
              "name": "https://www.twcert.org.tw/tw/cp-132-4575-2e32d-1.html",
              "refsource": "MISC",
              "url": "https://www.twcert.org.tw/tw/cp-132-4575-2e32d-1.html"
            }
          ]
        },
        "solution": [
          {
            "lang": "en",
            "value": "update BMC\u0027s firmwares to the following versions:\nZ10PR-D16 1.16.1\nASMB8-iKVM 1.16.1\nZ10PE-D16 WS 1.16.1"
          }
        ],
        "source": {
          "advisory": "TVN-202103032",
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
    "assignerShortName": "twcert",
    "cveId": "CVE-2021-28205",
    "datePublished": "2021-04-06T05:02:22.632520Z",
    "dateReserved": "2021-03-12T00:00:00",
    "dateUpdated": "2024-09-17T02:21:06.092Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted