2 lines
3.0 KiB
JSON
2 lines
3.0 KiB
JSON
{"affected":[{"affectedData":[{"product":"ZXCLOUD iRAI","vendor":"n/a","versions":[{"status":"affected","version":"All versions up to KVM-ProductV6.03.04"}]}],"source":"psirt@zte.com.cn"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:zte:zxcloud_irai:*:*:*:*:*:*:*:*","matchCriteriaId":"9EFAC29A-DE5B-42C6-9A48-8AE6419DB37C","versionEndExcluding":"6.03.04","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:a:zte:zxcloud_irai:-:*:*:*:*:*:*:*","matchCriteriaId":"96352962-7748-44B8-9490-B95202771469","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A CSRF vulnerability exists in the management page of a ZTE product.The vulnerability is caused because the management page does not fully verify whether the request comes from a trusted user. The attacker could submit a malicious request to the affected device to delete the data. This affects: ZXCLOUD iRAI All versions up to KVM-ProductV6.03.04"},{"lang":"es","value":"Se presenta una vulnerabilidad de tipo CSRF en la página de administración de un producto ZTE. La vulnerabilidad es debido a que la página de administración no verifica completamente si la petición proviene de un usuario confiable. El atacante podría enviar una petición maliciosa hacia el dispositivo afectado para eliminar los datos. Esto afecta: ZXCLOUD iRAI Todas las versiones hasta KVM-ProductV6.03.04"}],"id":"CVE-2021-21731","lastModified":"2026-06-17T03:36:03.343","metrics":{"cvssMetricV2":[{"acInsufInfo":false,"baseSeverity":"MEDIUM","cvssData":{"accessComplexity":"MEDIUM","accessVector":"NETWORK","authentication":"NONE","availabilityImpact":"PARTIAL","baseScore":5.8,"confidentialityImpact":"NONE","integrityImpact":"PARTIAL","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:P","version":"2.0"},"exploitabilityScore":8.6,"impactScore":4.9,"obtainAllPrivilege":false,"obtainOtherPrivilege":false,"obtainUserPrivilege":false,"source":"nvd@nist.gov","type":"Primary","userInteractionRequired":true}],"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2021-04-13T16:15:12.513","references":[{"source":"psirt@zte.com.cn","tags":["Vendor Advisory"],"url":"https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1014824"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"url":"https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1014824"}],"sourceIdentifier":"psirt@zte.com.cn","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-352"}],"source":"nvd@nist.gov","type":"Primary"}]}
|