Lucene search

K
cnvdChina National Vulnerability DatabaseCNVD-2022-91650
HistorySep 30, 2022 - 12:00 a.m.

fwupd information disclosure vulnerability

2022-09-3000:00:00
China National Vulnerability Database
www.cnvd.org.cn
12

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

fwupd is a plugin that supports firmware updates for session software on Linux platforms. fwupd 1.8.5 previously contained an information disclosure vulnerability that stemmed from the fact that when creating an OPERATOR user account on BMC, the redfish plugin saved the automatically generated password to /etc/fwupd/redfish.conf without restriction, and an attacker can exploit the vulnerability to read the same configuration file.

CPENameOperatorVersion
fwupd fwupdlt1.8.5

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N