CVE-2021-29212

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A remote unauthenticated directory traversal security vulnerability has been identified in HPE iLO Amplifier Pack versions 1.80, 1.81, 1.90 and 1.95. The vulnerability could be remotely exploited to allow an unauthenticated user to run arbitrary code leading complete impact to confidentiality, integrity, and availability of the iLO Amplifier Pack appliance.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
n/a	iLO Amplifier Pack	Ver 1.80, Ver 1.81, Ver 1.90, and Ver 1.95

References

https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn04189en_usVendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-21-1278/Third Party Advisory, VDB Entry
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn04189en_usVendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-21-1278/Third Party Advisory, VDB Entry

Timeline

Published: Nov 1, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-292136.7A potential local bypass of security restrictions vulnerability has been identified in HPE ProLiant DL20 Gen10, HPE ProLiant ML30 Gen10, and CVE-2021-292147.2A security vulnerability has been identified in HPE StoreServ Management Console (SSMC). An authenticated SSMC administrator could exploit t CVE-2021-292159.8A potential security vulnerability in HPE Ezmeral Data Fabric that may allow a remote access restriction bypass in the TEZ MapR ecosystem co CVE-2021-292166.1A remote cross-site scripting vulnerability was discovered in HPE OneView Global Dashboard version(s): Prior to 2.5. HPE has provided a soft CVE-2021-292176.1A remote URL redirection vulnerability was discovered in HPE OneView Global Dashboard version(s): Prior to 2.5. HPE has provided a software CVE-2021-292186.7A local unquoted search path security vulnerability has been identified in HPE Agentless Management Service for Windows version(s): Prior to CVE-2021-292197.8A potential local buffer overflow vulnerability has been identified in HPE FlexNetwork 5130 EL Switch Series version: Prior to 5130_EI_7.10.CVE-2021-292207.2Multiple buffer overflow security vulnerabilities have been identified in HPE iLO Amplifier Pack version(s): Prior to 2.12. These vulnerabil CVE-2021-292217.0A local privilege escalation vulnerability was discovered in Erlang/OTP prior to version 23.2.3. By adding files to an existing installation CVE-2021-292388.8CODESYS Automation Server before 1.16.0 allows cross-site request forgery (CSRF).CVE-2021-292397.8CODESYS Development System 3 before 3.5.17.0 displays or executes malicious documents or files embedded in libraries without first checking CVE-2021-292407.8The Package Manager of CODESYS Development System 3 before 3.5.17.0 does not check the validity of packages before installation and may be u