CVE-2021-29645
7.8
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Exploitability: 1.8 / Impact: 5.9
Source: NVD
Description
Hitachi JP1/IT Desktop Management 2 Agent 9 through 12 calls the SendMessageTimeoutW API with arbitrary arguments via a local pipe, leading to a local privilege escalation vulnerability. An attacker who exploits this issue could execute arbitrary code on the local system.
Affected (105)
Products: Hitachi: It Operations Director, Job Management Partner 1/it Desktop Management Manager, Job Management Partner 1/it Desktop Management 2 Manager, Job Management Partner 1/remote Control Agent, Job Management Partner 1/software Distribution Client, Job Management Partner 1/software Distribution Manager, Jp1/it Desktop Management Manager, Jp1/it Desktop Management 2 Manager, Jp1/it Desktop Management 2 Operations Director, Jp1/netm/dm Client, Jp1/netm/dm Client Remote Control Feature, Jp1/netm/dm Manager, Jp1/netm/remote Control Feature, Jp1/remote Control Feature
Configuration A
| Vulnerable Software | Affected Versions |
|---|---|
| 02-50 ≤ version ≤ 02-50-07 | |
| 09-50 ≤ version ≤ 09-50-03 | |
| 10-50 ≤ version ≤ 10-50-11 | |
| 08-00 ≤ version ≤ 08-00-04 | |
| 08-00 ≤ version ≤ 08-00-05 | |
| 08-00 ≤ version ≤ 08-00-07 | |
| 09-50 ≤ version ≤ 09-50-03 | |
| 10-50 ≤ version ≤ 10-50-12 | |
| 11-01 ≤ version ≤ 11-01-12 | |
| 08-00 ≤ version ≤ 08-00-09 | |
| 08-00 ≤ version ≤ 08-00-06 | |
| 08-00 ≤ version ≤ 08-00-09 | |
| 08-00 ≤ version ≤ 08-00-06 | |
| 11-00 ≤ version ≤ 11-00-02 |
| Running on/with | Platform Versions |
|---|---|
Microsoft Windows | All versions |
References (2)
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
Timeline
No history available yet.