CVE-2021-22439

There is a deserialization vulnerability in Huawei AnyOffice V200R006C10. An attacker can construct a specific request to exploit this vulnerability. Successfully exploiting this vulnerability, the attacker can execute remote malicious code injection and to control the device.

CVSS v3 8.1 HIGH
CVSS v2.0 9.3 HIGH

8.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

9.3^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:M/Au:N/C:C/I:C/A:C

Exploitability : 8.6 / Impact : 10.0

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20210619-01-injection-en	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:huawei:anyoffice:v200r006c10:*:*:*:*:*:*:*

History

No history.

Information

Published : 2021-06-29 19:15

Updated : 2024-02-28 18:28

NVD link : CVE-2021-22439

Mitre link : CVE-2021-22439

CVE.ORG link : CVE-2021-22439

JSON object : View

Products Affected

huawei

anyoffice

CWE

CWE-502

Deserialization of Untrusted Data

{"id": "CVE-2021-22439", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 9.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "MEDIUM", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.2}]}, "published": "2021-06-29T19:15:09.213", "references": [{"url": "https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20210619-01-injection-en", "tags": ["Vendor Advisory"], "source": "psirt@huawei.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-502"}]}], "descriptions": [{"lang": "en", "value": "There is a deserialization vulnerability in Huawei AnyOffice V200R006C10. An attacker can construct a specific request to exploit this vulnerability. Successfully exploiting this vulnerability, the attacker can execute remote malicious code injection and to control the device."}, {"lang": "es", "value": "Se presenta una vulnerabilidad de deserializaci\u00f3n en Huawei AnyOffice V200R006C10. Un atacante puede construir una petici\u00f3n espec\u00edfica para explotar esta vulnerabilidad. Al explotar con \u00e9xito esta vulnerabilidad, el atacante puede ejecutar una inyecci\u00f3n de c\u00f3digo malicioso a distancia y controlar el dispositivo"}], "lastModified": "2021-07-02T19:57:25.147", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:huawei:anyoffice:v200r006c10:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EF68F7A6-4286-4097-A85F-DDD5DF45B6FB"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@huawei.com"}