CVE-2021-29218: hpe agentless_management Unquoted Search Path or Element

Vulnerability summary

CVE-2021-29218 is a medium (CVSS 6.7) Unquoted Search Path or Element vulnerability in hpe agentless_management. EPSS estimates a 0.24% chance of exploitation in the next 30 days, higher than 13.8% of scored vulnerabilities.

Timeline

1. 04-02-2022
   PublishedVulnerability first disclosed.
2. 03-08-2024
   Last modifiedVulnerability information updated.

Description

A local unquoted search path security vulnerability has been identified in HPE Agentless Management Service for Windows version(s): Prior to 1.44.0.0, 10.96.0.0. This vulnerability could be exploited locally by a user with high privileges to execute malware that may lead to a loss of confidentiality, integrity, and availability. HPE has provided software updates to resolve the vulnerability in HPE Agentless Management Service for Windows.

• CWE-428Unquoted Search Path or ElementThe product uses a search path that contains an unquoted element, in which the element contains whitespace or other separators. This can cause the product to access resources in a parent path.