Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2020-9115

ManageOne versions 6.5.1.1.B010, 6.5.1.1.B020, 6.5.1.1.B030, 6.5.1.1.B040, ,6.5.1.1.B050, 8.0.0 and 8.0.1 have a command injection vulnerability. An attacker with high privileges may exploit this vulnerability through some operations on the plug-in component. Due to insufficient input validation of some parameters, the attacker can exploit this vulnerability to inject commands to the target device.

Published

2020-12-01T00:15:11.320

Last Modified

2024-11-21T05:40:04.293

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 7.2 (HIGH)

CVSSv2 Vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: SINGLE
  • Confidentiality Impact: COMPLETE
  • Integrity Impact: COMPLETE
  • Availability Impact: COMPLETE
Exploitability Score

8.0

Impact Score

10.0

Weaknesses
  • Type: Primary
    CWE-20
    CWE-77
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application huawei manageone 6.5.0 Yes
Application huawei manageone 6.5.1.1 Yes
Application huawei manageone 6.5.1.1 Yes
Application huawei manageone 6.5.1.1 Yes
Application huawei manageone 6.5.1.1 Yes
Application huawei manageone 6.5.1.1 Yes
Application huawei manageone 8.0.0 Yes
Application huawei manageone 8.0.1 Yes
References