CVE-2021-37130

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

There is a path traversal vulnerability in Huawei FusionCube 6.0.2.The vulnerability is due to that the software uses external input to construct a pathname that is intended to identify a directory that is located underneath a restricted parent directory, but the software does not properly validate the pathname. Successful exploit could allow the attacker to access a location that is outside of the restricted directory by a crafted filename.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published: Oct 27, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-371316.8There is a CSV injection vulnerability in ManageOne, iManager NetEco and iManager NetEco 6000. An attacker with high privilege may exploit t CVE-2021-371325.3PackageManagerService has a Permissions, Privileges, and Access Controls vulnerability .Successful exploitation of this vulnerability may ca CVE-2021-371337.5There is an Unauthorized file access vulnerability in Smartphones.Successful exploitation of this vulnerability may affect service confident CVE-2021-371348.1Location-related APIs exists a Race Condition vulnerability.Successful exploitation of this vulnerability may use Higher Permissions for inv CVE-2021-371367.5The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocati CVE-2021-371377.5The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage. Beside this it also may buffer CVE-2021-37145.9A flaw was found in the Linux kernels memory deduplication mechanism. Previous work has shown that memory deduplication can be attacked via CVE-2021-371449.1CSZ CMS 1.2.9 is vulnerable to Arbitrary File Deletion. This occurs in PHP when the unlink() function is called and user input might affect CVE-2021-371457.2A command-injection vulnerability in an authenticated Telnet connection in Poly (formerly Polycom) CX5500 and CX5100 1.3.5 leads an attacker CVE-2021-371467.5An infinite loop in Open Robotics ros_comm XMLRPC server in ROS Melodic through 1.4.11 and ROS Noetic through1.15.11 allows remote attackers CVE-2021-371477.5Improper input validation vulnerability in header parsing of Apache Traffic Server allows an attacker to smuggle requests. This issue affect CVE-2021-371487.5Improper input validation vulnerability in header parsing of Apache Traffic Server allows an attacker to smuggle requests. This issue affect