VulnerabilityModified

CVE-2021-37106

There is a command injection vulnerability in CMA service module of FusionCompute 6.3.0, 6.3.1, 6.5.0 and 8.0.0 when processing the default certificate file.

HIGH 7.2EPSS 0.90%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.90%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

There is a command injection vulnerability in CMA service module of FusionCompute 6.3.0, 6.3.1, 6.5.0 and 8.0.0 when processing the default certificate file. The software constructs part of a command using external special input from users, but the software does not sufficiently validate the user input. Successful exploit could allow the attacker to inject certain commands to the system.

CVSS 3.1: 7.2 HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS: 0.90% probability · 58th percentile
CISA KEV: Not listed
Weakness: CWE-77
Affected: huawei/fusioncompute
Source: psirt@huawei.com

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.