CVE-2021-25129: Path Traversal

Published Jan 29, 2021

Updated

The Baseboard Management Controller(BMC) in HPE Cloudline CL5800 Gen9 Server; HPE Cloudline CL5200 Gen9 Server; HPE Cloudline CL4100 Gen10 Server; HPE Cloudline CL3100 Gen10 Server; HPE Cloudline CL5800 Gen10 Server BMC firmware has a local spxrestservice getvideodatafunc function path traversal vulnerability.

Affected Software

12 affected components

HPE Cloudline Cl3100 Gen10 Server Firmware=1.08.0.0

HPE Cloudline Cl3100 Gen10 Server Firmware=1.10.0.0

HPE Cloudline CL3100 Gen10 Server

HPE Cloudline Cl4100 Gen10 Server Firmware=1.08.0.0

HPE Cloudline Cl4100 Gen10 Server Firmware=1.10.0.0

HPE Cloudline CL4100 Gen10 Server

HPE Cloudline Cl5200 Gen9 Server Firmware=1.07.0.0

HPE Cloudline CL5200 Gen9 Server

HPE Cloudline Cl5800 Gen10 Server Firmware=1.08.0.0

HPE Cloudline CL5800 Gen10 Server

HPE Cloudline Cl5800 Gen9 Server Firmware=1.09.0.0

HPE Cloudline CL5800 Gen9 Server

Event History

Jan 29, 2021

CVE Published

via MITRE·06:11 PM

Data Sourced

via MITRE·06:11 PM

DescriptionWeakness

Frequently Asked Questions

What is CVE-2021-25129?

CVE-2021-25129 is a baseboard management controller vulnerability in HPE Cloudline servers.

Which HPE Cloudline servers are affected by CVE-2021-25129?

HPE Cloudline CL5800 Gen9 Server, HPE Cloudline CL5200 Gen9 Server, HPE Cloudline CL4100 Gen10 Server, HPE Cloudline CL3100 Gen10 Server, and HPE Cloudline CL5800 Gen10 Server are affected by CVE-2021-25129.

What is the severity of CVE-2021-25129?

CVE-2021-25129 has a severity rating of 7.8 (High).

How does CVE-2021-25129 affect HPE Cloudline servers?

CVE-2021-25129 allows a local attacker to perform a path traversal attack on the baseboard management controller firmware of HPE Cloudline servers.

How can I fix CVE-2021-25129?

To fix CVE-2021-25129, install the appropriate BMC firmware updates provided by HPE and follow any additional mitigation steps mentioned in the advisory.