CVE-2021-29203 Auth bypass in HPE Edgeline Infrastructure Management Software
Remote attackers can bypass authentication to execute arbitrary commands, gain privileged access, cause denial of service, and modify configuration in HPE Edgeline Infrastructure Manager.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-29203?
CVE-2021-29203 is a critical authentication bypass vulnerability in HPE Edgeline Infrastructure Management Software, published on 6 May 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A security vulnerability has been identified in the HPE Edgeline Infrastructure Manager, also known as HPE Edgeline Infrastructure Management Software, prior to version 1.22. The vulnerability could be remotely exploited to bypass remote authentication leading to execution of arbitrary commands, gaining privileged access, causing denial of service, and changing the configuration. HPE has released a software update to resolve the vulnerability in the HPE Edgeline Infrastructure Manager.
Weakness: CWE-306
Which versions are affected by CVE-2021-29203?
It affects 1 product.
Products include Hp Edgeline Infrastructure Manager.
How do I fix CVE-2021-29203?
No fix has been published for CVE-2021-29203 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2021-29203 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2021-29203 exists.
Public exploit code: 1 Nuclei template.
Other vulnerabilities in HPE Edgeline Infrastructure Management Software
Sources
Also known as GHSA-cp6r-8qhx-6m32.