CVE-2021-23280: Arbitrary File upload
Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to authenticated arbitrary file upload vulnerability. IPM’s mapssrv.js allows an attacker to upload a malicious NodeJS file using uploadBackgroud action. An attacker can upload a malicious code or execute any command using a specially crafted packet to exploit the vulnerability.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is CVE-2021-23280?
CVE-2021-23280 is a vulnerability in Eaton Intelligent Power Manager (IPM) prior to 1.69 that allows an attacker to upload a malicious NodeJS file.
How severe is CVE-2021-23280?
CVE-2021-23280 has a severity rating of 9.9 out of 10, which is considered critical.
How does CVE-2021-23280 affect Eaton Intelligent Power Manager?
CVE-2021-23280 affects Eaton Intelligent Power Manager versions prior to 1.69, allowing an attacker to perform an authenticated arbitrary file upload.
How can an attacker exploit CVE-2021-23280?
An attacker can exploit CVE-2021-23280 by uploading a malicious NodeJS file using the 'uploadBackground' action in IPM's 'maps_srv.js' file.
Is there a fix for CVE-2021-23280?
Yes, updating Eaton Intelligent Power Manager to version 1.69 or higher will fix the CVE-2021-23280 vulnerability.