CVE-2021-25125: hpe cloudline_cl3100_gen10_server_firmware Path Traversal

Vulnerability summary

CVE-2021-25125 is a high (CVSS 7.8) Path Traversal vulnerability in hpe cloudline_cl3100_gen10_server_firmware. EPSS estimates a 0.42% chance of exploitation in the next 30 days, higher than 34.7% of scored vulnerabilities.

Timeline

1. 29-01-2021
   PublishedVulnerability first disclosed.
2. 03-08-2024
   Last modifiedVulnerability information updated.

Description

The Baseboard Management Controller(BMC) in HPE Cloudline CL5800 Gen9 Server; HPE Cloudline CL5200 Gen9 Server; HPE Cloudline CL4100 Gen10 Server; HPE Cloudline CL3100 Gen10 Server; HPE Cloudline CL5800 Gen10 Server BMC firmware has a local spx_restservice delsolrecordedvideo_func function path traversal vulnerability.

• CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.