Lucene search

[email protected]CVE-2010-2656

HistoryJul 08, 2010 - 12:54 p.m.

CVE-2010-2656

2010-07-0812:54:47

CWE-264

[email protected]

web.nvd.nist.gov

ibm bladecenter

amm firmware

cve-2010-2656

access control

remote attack

security vulnerability

6.6 Medium

AI Score

Confidence

Low

5 Medium

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

0.426 Medium

EPSS

Percentile

97.3%

JSON

The IBM BladeCenter with Advanced Management Module (AMM) firmware build ID BPET48L, and possibly other versions before 4.7 and 5.0, stores sensitive information under the web root with insufficient access control, which allows remote attackers to download (1) logs or (2) core files via direct requests, as demonstrated by a request for private/sdc.tgz.

Affected configurations

NVD

Node

ibmadvanced_management_moduleRange≤2.48l

ibmadvanced_management_moduleMatch1.00

ibmadvanced_management_moduleMatch1.01

ibmadvanced_management_moduleMatch1.20

ibmadvanced_management_moduleMatch1.20f

ibmadvanced_management_moduleMatch1.25

ibmadvanced_management_moduleMatch1.25e

ibmadvanced_management_moduleMatch1.25i

ibmadvanced_management_moduleMatch1.26b

ibmadvanced_management_moduleMatch1.26e

ibmadvanced_management_moduleMatch1.26h

ibmadvanced_management_moduleMatch1.26i

ibmadvanced_management_moduleMatch1.26k

ibmadvanced_management_moduleMatch1.28g

ibmadvanced_management_moduleMatch1.32d

ibmadvanced_management_moduleMatch1.34b

ibmadvanced_management_moduleMatch1.34e

ibmadvanced_management_moduleMatch1.36d

ibmadvanced_management_moduleMatch1.36g

ibmadvanced_management_moduleMatch1.36h

ibmadvanced_management_moduleMatch1.36k

ibmadvanced_management_moduleMatch1.42d

ibmadvanced_management_moduleMatch1.42f

ibmadvanced_management_moduleMatch1.42i

ibmadvanced_management_moduleMatch1.42n

ibmadvanced_management_moduleMatch1.42o

ibmadvanced_management_moduleMatch1.42t

ibmadvanced_management_moduleMatch2.46c

ibmadvanced_management_moduleMatch2.46j

ibmadvanced_management_moduleMatch2.48c

ibmadvanced_management_moduleMatch2.48d

ibmadvanced_management_moduleMatch2.48g

ibmadvanced_management_moduleMatch2.48n

ibmadvanced_management_moduleMatch2.50c

ibmadvanced_management_moduleMatch2.50g

ibmadvanced_management_moduleMatch2.50k

ibmadvanced_management_moduleMatch2.50p

AND

ibmbladecenter

CPENameOperatorVersion
ibm:advanced_management_moduleibm advanced management modulele2.48
ibm:advanced_management_moduleibm advanced management moduleeq1.00
ibm:advanced_management_moduleibm advanced management moduleeq1.01
ibm:advanced_management_moduleibm advanced management moduleeq1.20
ibm:advanced_management_moduleibm advanced management moduleeq1.25
ibm:advanced_management_moduleibm advanced management moduleeq1.26
ibm:advanced_management_moduleibm advanced management moduleeq1.28
ibm:advanced_management_moduleibm advanced management moduleeq1.32
ibm:advanced_management_moduleibm advanced management moduleeq1.34
ibm:advanced_management_moduleibm advanced management moduleeq1.36

CPE	Name	Operator	Version
ibm:advanced_management_module	ibm advanced management module	le	2.48
ibm:advanced_management_module	ibm advanced management module	eq	1.00
ibm:advanced_management_module	ibm advanced management module	eq	1.01
ibm:advanced_management_module	ibm advanced management module	eq	1.20
ibm:advanced_management_module	ibm advanced management module	eq	1.25
ibm:advanced_management_module	ibm advanced management module	eq	1.26
ibm:advanced_management_module	ibm advanced management module	eq	1.28
ibm:advanced_management_module	ibm advanced management module	eq	1.32
ibm:advanced_management_module	ibm advanced management module	eq	1.34
ibm:advanced_management_module	ibm advanced management module	eq	1.36

Rows per page:

1-10 of 131

References

dsecrg.com/pages/vul/show.php?id=154

osvdb.org/66123

www.exploit-db.com/exploits/14237/

www.securityfocus.com/bid/41383

6.6 Medium

AI Score

Confidence

Low

5 Medium

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

0.426 Medium

EPSS

Percentile

97.3%

JSON

Related for CVE-2010-2656

nvd1 prion1 cvelist1