Lucene search

[email protected]CVE-2013-3609

HistorySep 08, 2013 - 3:17 a.m.

CVE-2013-3609

2013-09-0803:17:39

CWE-20

[email protected]

web.nvd.nist.gov

supermicro

ipmi

cve-2013-3609

authorization

javascript

security vulnerability

10 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

6.7 Medium

AI Score

Confidence

Low

0.016 Low

EPSS

Percentile

87.6%

JSON

The web interface in the Intelligent Platform Management Interface (IPMI) implementation on Supermicro H8DC*, H8DG*, H8SCM-F, H8SGL-F, H8SM*, X7SP*, X8DT*, X8SI*, X9DAX-, X9DB, X9DR*, X9QR*, X9SBAA-F, X9SC*, X9SPU-F, and X9SR* devices relies on JavaScript code on the client for authorization checks, which allows remote authenticated users to bypass intended access restrictions via a crafted request, related to the PrivilegeCallBack function.

Affected configurations

NVD

Node

supermicroh8dcl-6fMatch-

supermicroh8dcl-ifMatch-

supermicroh8dct-hibqfMatch-

supermicroh8dct-hln4fMatch-

supermicroh8dct-ibqfMatch-

supermicroh8dg6-fMatch-

supermicroh8dgg-qfMatch-

supermicroh8dgi-fMatch-

supermicroh8dgt-hfMatch-

supermicroh8dgt-hibqfMatch-

supermicroh8dgt-hlfMatch-

supermicroh8dgt-hlibqfMatch-

supermicroh8dgu-fMatch-

supermicroh8dgu-ln4f\+Match-

supermicroh8scm-fMatch-

supermicroh8sgl-fMatch-

supermicroh8sme-fMatch-

supermicroh8sml-7Match-

supermicroh8sml-7fMatch-

supermicroh8sml-iMatch-

supermicroh8sml-ifMatch-

supermicrox7spa-hfMatch-

supermicrox7spa-hf-d525Match-

supermicrox7spe-h-d525Match-

supermicrox7spe-hfMatch-

supermicrox7spe-hf-d525Match-

supermicrox7spt-df-d525Match-

supermicrox7spt-df-d525\+Match-

supermicrox8dtl-3fMatch-

supermicrox8dtl-6fMatch-

supermicrox8dtl-ifMatch-

supermicrox8dtn\+-fMatch-

supermicrox8dtn\+-f-lrMatch-

supermicrox8dtu-6f\+Match-

supermicrox8dtu-6f\+-lrMatch-

supermicrox8dtu-6tf\+Match-

supermicrox8dtu-6tf\+-lrMatch-

supermicrox8dtu-ln4f\+Match-

supermicrox8dtu-ln4f\+-lrMatch-

supermicrox8si6-fMatch-

supermicrox8sia-fMatch-

supermicrox8sie-fMatch-

supermicrox8sie-ln4fMatch-

supermicrox8sil-fMatch-

supermicrox8sit-fMatch-

supermicrox8sit-hfMatch-

supermicrox8siu-fMatch-

supermicrox9dax-7fMatch-

supermicrox9dax-7f-hftMatch-

supermicrox9dax-7tfMatch-

supermicrox9dax-ifMatch-

supermicrox9dax-if-hftMatch-

supermicrox9dax-itfMatch-

supermicrox9db3-fMatch-

supermicrox9db3-tpfMatch-

supermicrox9dbi-fMatch-

supermicrox9dbi-tpfMatch-

supermicrox9dbl-3fMatch-

supermicrox9dbl-ifMatch-

supermicrox9dbu-3fMatch-

supermicrox9dbu-ifMatch-

supermicrox9dr3-fMatch-

supermicrox9dr3-ln4f\+Match-

supermicrox9dr7-ln4fMatch-

supermicrox9dr7-ln4f-jbodMatch-

supermicrox9dr7-tf\+Match-

supermicrox9drd-7jln4fMatch-

supermicrox9drd-7ln4fMatch-

supermicrox9drd-7ln4f-jbodMatch-

supermicrox9drd-efMatch-

supermicrox9drd-ifMatch-

supermicrox9dre-ln4fMatch-

supermicrox9dre-tf\+Match-

supermicrox9drffMatch-

supermicrox9drff-7Match-

supermicrox9drff-7\+Match-

supermicrox9drff-7g\+Match-

supermicrox9drff-7t\+Match-

supermicrox9drff-7tg\+Match-

supermicrox9drff-i\+Match-

supermicrox9drff-ig\+Match-

supermicrox9drff-it\+Match-

supermicrox9drff-itg\+Match-

supermicrox9drfrMatch-

supermicrox9drg-hfMatch-

supermicrox9drg-hf\+Match-

supermicrox9drg-htfMatch-

supermicrox9drg-htf\+Match-

supermicrox9drh-7fMatch-

supermicrox9drh-7tfMatch-

supermicrox9drh-ifMatch-

supermicrox9drh-itfMatch-

supermicrox9dri-fMatch-

supermicrox9dri-ln4f\+Match-

supermicrox9drl-3fMatch-

supermicrox9drl-efMatch-

supermicrox9drl-ifMatch-

supermicrox9drt-fMatch-

supermicrox9drt-h6fMatch-

supermicrox9drt-h6ibffMatch-

supermicrox9drt-h6ibqfMatch-

supermicrox9drt-hf\+Match-

supermicrox9drt-ibffMatch-

supermicrox9drt-ibqfMatch-

supermicrox9drw-3ln4f\+Match-

supermicrox9drw-3tf\+Match-

supermicrox9drw-7tpf\+Match-

supermicrox9drw-itpf\+Match-

supermicrox9drx\+-fMatch-

supermicrox9qr7-tfMatch-

supermicrox9qr7-tf\+Match-

supermicrox9qr7-tf-jbodMatch-

supermicrox9qri-fMatch-

supermicrox9qri-f\+Match-

supermicrox9sbaa-fMatch-

supermicrox9sca-fMatch-

supermicrox9scd-fMatch-

supermicrox9sce-fMatch-

supermicrox9scff-fMatch-

supermicrox9sci-ln4fMatch-

supermicrox9scl\+-fMatch-

supermicrox9scl-fMatch-

supermicrox9scm-fMatch-

supermicrox9scm-iifMatch-

supermicrox9spu-fMatch-

supermicrox9srd-fMatch-

supermicrox9sre-3fMatch-

supermicrox9sre-fMatch-

supermicrox9srg-fMatch-

supermicrox9sri-3fMatch-

supermicrox9sri-fMatch-

supermicrox9srl-fMatch-

supermicrox9srw-fMatch-

CPENameOperatorVersion
supermicro:h8dcl-6fsupermicro h8dcl-6feq-
supermicro:h8dcl-ifsupermicro h8dcl-ifeq-
supermicro:h8dct-hibqfsupermicro h8dct-hibqfeq-
supermicro:h8dct-hln4fsupermicro h8dct-hln4feq-
supermicro:h8dct-ibqfsupermicro h8dct-ibqfeq-
supermicro:h8dg6-fsupermicro h8dg6-feq-
supermicro:h8dgg-qfsupermicro h8dgg-qfeq-
supermicro:h8dgi-fsupermicro h8dgi-feq-
supermicro:h8dgt-hfsupermicro h8dgt-hfeq-
supermicro:h8dgt-hibqfsupermicro h8dgt-hibqfeq-

CPE	Name	Operator	Version
supermicro:h8dcl-6f	supermicro h8dcl-6f	eq	-
supermicro:h8dcl-if	supermicro h8dcl-if	eq	-
supermicro:h8dct-hibqf	supermicro h8dct-hibqf	eq	-
supermicro:h8dct-hln4f	supermicro h8dct-hln4f	eq	-
supermicro:h8dct-ibqf	supermicro h8dct-ibqf	eq	-
supermicro:h8dg6-f	supermicro h8dg6-f	eq	-
supermicro:h8dgg-qf	supermicro h8dgg-qf	eq	-
supermicro:h8dgi-f	supermicro h8dgi-f	eq	-
supermicro:h8dgt-hf	supermicro h8dgt-hf	eq	-
supermicro:h8dgt-hibqf	supermicro h8dgt-hibqf	eq	-

Rows per page:

1-10 of 1331

References

www.kb.cert.org/vuls/id/648646

www.securityfocus.com/bid/62098

www.supermicro.com/products/nfo/files/IPMI/CVE_Update.pdf

www.thomas-krenn.com/en/wiki/Supermicro_IPMI_Security_Updates_November_2013

support.citrix.com/article/CTX216642

www.usenix.org/system/files/conference/woot13/woot13-bonkoski_0.pdf

10 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

6.7 Medium

AI Score

Confidence

Low

0.016 Low

EPSS

Percentile

87.6%

JSON

Related for CVE-2013-3609

cvelist1 prion1 nvd1 cert1