CVE-2021-22298 Business logic in ManageOne
An attacker with permissions can execute specific SQL statements to cause service abnormality in Huawei Gauss100 OLTP within ManageOne.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-22298?
CVE-2021-22298 is a medium-severity vulnerability in ManageOne, published on 6 Feb 2021. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
There is a logic vulnerability in Huawei Gauss100 OLTP Product. An attacker with certain permissions could perform specific SQL statement to exploit this vulnerability. Due to insufficient security design, successful exploit can cause service abnormal. Affected product versions include: ManageOne versions 6.5.1.1.B020, 6.5.1.1.B030, 6.5.1.1.B040, 6.5.1.SPC100.B050, 6.5.1.SPC101.B010, 6.5.1.SPC101.B040, 6.5.1.SPC200, 6.5.1.SPC200.B010, 6.5.1.SPC200.B030, 6.5.1.SPC200.B040, 6.5.1.SPC200.B050, 6.5.1.SPC200.B060, 6.5.1.SPC200.B070, 6.5.1RC1.B070, 6.5.1RC1.B080, 6.5.1RC2.B040, 6.5.1RC2.B050, 6.5.1RC2.B060, 6.5.1RC2.B070, 6.5.1RC2.B080, 6.5.1RC2.B090.
Which versions are affected by CVE-2021-22298?
It affects 1 product.
Products include Huawei Manageone.
How do I fix CVE-2021-22298?
Apply the vendor's patch.
Is CVE-2021-22298 being exploited?
There is no known exploitation of CVE-2021-22298 in the wild and no public exploit code.
Other vulnerabilities in ManageOne
Sources
Also known as GHSA-hphj-4pmp-q6gf.