CVE-2021-42773 Path traversal in n/a
An unauthenticated attacker can retrieve arbitrary files from a remote host via the GetDumpFile command if the software is not in Strictly Local Management mode.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-42773?
CVE-2021-42773 is a high-severity path traversal vulnerability in n/a, published on 12 Nov 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Broadcom Emulex HBA Manager/One Command Manager versions before 11.4.425.0 and 12.8.542.31, if not installed in Strictly Local Management mode, could allow a user to retrieve an arbitrary file from a remote host with the GetDumpFile command. In non-secure mode, the user is unauthenticated.
Which versions are affected by CVE-2021-42773?
It affects 1 product.
Products include Broadcom Emulex Hba Manager.
How do I fix CVE-2021-42773?
No fix has been published for CVE-2021-42773 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2021-42773 being exploited?
There is no known exploitation of CVE-2021-42773 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-487f-h6j7-w985.