CVE-2021-23280: falha de alta gravidade em Eaton Intelligent Power manager (IPM)
Arbitrary File upload
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8epss 0.9%
Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to authenticated arbitrary file upload vulnerability. IPM’s maps_srv.js allows an attacker to upload a malicious NodeJS file using uploadBackgroud action. An attacker can upload a malicious code or execute any command using a specially crafted packet to exploit the vulnerability.
CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Produtos afetados
Eaton · Intelligent Power manager (IPM)CVEs relacionadas — Eaton Intelligent Power manager (IPM)
No mesmo produto, das mais perigosas para as menos.
CVE-2021-23279HIGHArbitrary File deleteEPSS 27.9%CVE-2021-23281CRITICALRemote Code executionEPSS 2.3%CVE-2020-6651HIGHCommand injection via specially crafted file name during config file uploadEPSS 2.1%CVE-2021-23278HIGHArbitrary File deleteEPSS 1.1%CVE-2021-23277HIGHImproper Neutralization of Directives in Dynamically Evaluated CodeEPSS 1.0%CVE-2021-23276HIGHImproper Neutralization of Special Elements used in an SQL CommandEPSS 0.8%