Sign-up

ID

VAR-202111-1463


CVE

CVE-2021-36300


TITLE

iDRAC9  In  SQL  Injection vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2021-015446

DESCRIPTION

iDRAC9 versions prior to 5.00.00.00 contain an improper input validation vulnerability. An unauthenticated remote attacker may potentially exploit this vulnerability by sending a specially crafted malicious request to crash the webserver or cause information disclosure. iDRAC9 for, SQL There is an injection vulnerability.Information is obtained and service operation is interrupted (DoS) It may be in a state

Trust: 1.8

sources: NVD: CVE-2021-36300 // JVNDB: JVNDB-2021-015446 // VULHUB: VHN-398184 // VULMON: CVE-2021-36300

AFFECTED PRODUCTS

vendor:dellmodel:emc idrac9scope:ltversion:5.00.00.00

Trust: 1.0

vendor:デルmodel:idrac9scope:eqversion: -

Trust: 0.8

vendor:デルmodel:idrac9scope:eqversion:idrac9 firmware 5.00.00.00

Trust: 0.8

sources: JVNDB: JVNDB-2021-015446 // NVD: CVE-2021-36300

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2021-36300
value: HIGH

Trust: 1.0

security_alert@emc.com: CVE-2021-36300
value: MEDIUM

Trust: 1.0

NVD: CVE-2021-36300
value: HIGH

Trust: 0.8

CNNVD: CNNVD-202111-769
value: MEDIUM

Trust: 0.6

VULHUB: VHN-398184
value: MEDIUM

Trust: 0.1

VULMON: CVE-2021-36300
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2021-36300
severity: MEDIUM
baseScore: 6.4
vectorString: AV:N/AC:L/AU:N/C:P/I:N/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 4.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

VULHUB: VHN-398184
severity: MEDIUM
baseScore: 6.4
vectorString: AV:N/AC:L/AU:N/C:P/I:N/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 4.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2021-36300
baseSeverity: HIGH
baseScore: 8.2
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: LOW
exploitabilityScore: 3.9
impactScore: 4.2
version: 3.1

Trust: 1.0

security_alert@emc.com: CVE-2021-36300
baseSeverity: MEDIUM
baseScore: 6.5
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: LOW
exploitabilityScore: 2.2
impactScore: 4.2
version: 3.1

Trust: 1.0

NVD: CVE-2021-36300
baseSeverity: HIGH
baseScore: 8.2
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: LOW
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: VULHUB: VHN-398184 // VULMON: CVE-2021-36300 // JVNDB: JVNDB-2021-015446 // CNNVD: CNNVD-202111-769 // NVD: CVE-2021-36300 // NVD: CVE-2021-36300

PROBLEMTYPE DATA

problemtype:CWE-89

Trust: 1.1

problemtype:SQL injection (CWE-89) [ others ]

Trust: 0.8

sources: VULHUB: VHN-398184 // JVNDB: JVNDB-2021-015446 // NVD: CVE-2021-36300

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202111-769

TYPE

SQL injection

Trust: 0.6

sources: CNNVD: CNNVD-202111-769

PATCH

title:DSA-2021-177url:https://www.dell.com/support/kbdoc/ja-jp/000191229/dsa-2021-177-dell-emc-idrac-security-update-for-multiple-security-vulnerabilities

Trust: 0.8

title:Dell Emc Idrac SQL Repair measures for injecting vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=173018

Trust: 0.6

title: - url:https://github.com/chnzzh/iDRAC-CVE-lib

Trust: 0.1

sources: VULMON: CVE-2021-36300 // JVNDB: JVNDB-2021-015446 // CNNVD: CNNVD-202111-769

EXTERNAL IDS

db:NVDid:CVE-2021-36300

Trust: 3.4

db:JVNDBid:JVNDB-2021-015446

Trust: 0.8

db:CNNVDid:CNNVD-202111-769

Trust: 0.6

db:VULHUBid:VHN-398184

Trust: 0.1

db:VULMONid:CVE-2021-36300

Trust: 0.1

sources: VULHUB: VHN-398184 // VULMON: CVE-2021-36300 // JVNDB: JVNDB-2021-015446 // CNNVD: CNNVD-202111-769 // NVD: CVE-2021-36300

REFERENCES

url:https://support.emc.com/kb/000191229

Trust: 1.8

url:https://nvd.nist.gov/vuln/detail/cve-2021-36300

Trust: 1.4

url:https://vigilance.fr/vulnerability/dell-emc-idrac-three-vulnerabilities-36830

Trust: 0.6

url:https://cwe.mitre.org/data/definitions/89.html

Trust: 0.1

url:https://nvd.nist.gov

Trust: 0.1

url:https://github.com/chnzzh/idrac-cve-lib

Trust: 0.1

sources: VULHUB: VHN-398184 // VULMON: CVE-2021-36300 // JVNDB: JVNDB-2021-015446 // CNNVD: CNNVD-202111-769 // NVD: CVE-2021-36300

SOURCES

db:VULHUBid:VHN-398184
db:VULMONid:CVE-2021-36300
db:JVNDBid:JVNDB-2021-015446
db:CNNVDid:CNNVD-202111-769
db:NVDid:CVE-2021-36300

LAST UPDATE DATE

2024-08-14T14:11:10.926000+00:00


SOURCES UPDATE DATE

db:VULHUBid:VHN-398184date:2021-11-26T00:00:00
db:VULMONid:CVE-2021-36300date:2021-11-26T00:00:00
db:JVNDBid:JVNDB-2021-015446date:2022-11-21T07:05:00
db:CNNVDid:CNNVD-202111-769date:2021-12-07T00:00:00
db:NVDid:CVE-2021-36300date:2021-11-26T21:08:54.740

SOURCES RELEASE DATE

db:VULHUBid:VHN-398184date:2021-11-23T00:00:00
db:VULMONid:CVE-2021-36300date:2021-11-23T00:00:00
db:JVNDBid:JVNDB-2021-015446date:2022-11-21T00:00:00
db:CNNVDid:CNNVD-202111-769date:2021-11-09T00:00:00
db:NVDid:CVE-2021-36300date:2021-11-23T20:15:10.853