CVE-2021-36348CWE-89

iDRAC9 versions prior to 5.00.20.00 contain an input injection vulnerability

Medium · published January 25, 2022

CVSS v3.0
5.9
EPSS
1%
Percentile
66.2
In the wild
Unconfirmed
What it is

iDRAC9 versions prior to 5.00.20.00 contain an input injection vulnerability. A remote authenticated malicious user with low privileges may potentially exploit this vulnerability to cause information disclosure or denial of service by supplying specially crafted input data to iDRAC.

The record
Technical detail
CVSS v3.0
5.9 · MEDIUM
Vector
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.01132 · 66.2th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2022-01-25T22:15Z
EPSS history
Timeline
  • 25 JAN 22:15Z
    iDRAC9 versions prior to 5.00.20.00 contain an input injection vulnerability
    cvelistv5