SQL injection in iDRAC9 - CVE-2021-36299
Published: August 9, 2022
Vulnerability identifier: #VU66207
CSH Severity: Medium
CVSS v4: 7.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2021-36299
CWE-ID: CWE-89
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary SQL queries in database.
The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can send a specially crafted request to the affected application and execute arbitrary SQL commands within the application database.
Successful exploitation of this vulnerability may allow a remote attacker to read, delete, modify data in database and gain complete control over the affected application.
Affected software
iDRAC9
Dell EMC VxRail Appliance
PowerScale OneFS
Dell EMC VxRail Appliance
PowerScale OneFS
How to mitigate CVE-2021-36299
Install update from vendor's website.
iDRAC9 - addressed in versions 4.40.29.00, 5.00.00.00
Dell EMC VxRail Appliance - update to 7.0.300
PowerScale OneFS - update to 11.7
Dell EMC VxRail Appliance - update to 7.0.300
PowerScale OneFS - update to 11.7