CVE-2021-37102 Command injection in FusionCompute

High 8.8 Published 23 Nov 2021 Updated 4 Aug 2024

Attackers can inject commands via the CMA service module in FusionCompute, leading to arbitrary code execution on the system.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2021-37102?

CVE-2021-37102 is a high-severity command injection vulnerability in FusionCompute, published on 23 Nov 2021. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

There is a command injection vulnerability in CMA service module of FusionCompute product when processing the default certificate file. The software constructs part of a command using external special input from users, but the software does not sufficiently validate the user input. Successful exploit could allow the attacker to inject certain commands to the system. Affected product versions include: FusionCompute 6.0.0, 6.3.0, 6.3.1, 6.5.0, 6.5.1, 8.0.0.

Weakness: CWE-77

Which versions are affected by CVE-2021-37102?

It affects 1 product.

Products include Huawei Fusioncompute.

How do I fix CVE-2021-37102?

No fix has been published for CVE-2021-37102 yet. Limit exposure of the affected software until one is available.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2021-37102 being exploited?

There is no known exploitation of CVE-2021-37102 in the wild and no public exploit code.

Sources

Also known as GHSA-gpc3-vjh4-7wm2.