Lucene search

[email protected]CVE-2023-2993

HistoryJun 26, 2023 - 8:15 p.m.

CVE-2023-2993

2023-06-2620:15:10

CWE-281

[email protected]

web.nvd.nist.gov

cve-2023-2993

authenticated user

web management server

api

smm

fpc

security vulnerability

nvd

6.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

6.4 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

13.5%

JSON

A valid, authenticated user with limited privileges may be able to use specifically crafted web management server API calls to execute a limited number of commands on SMM v1, SMM v2, and FPC that the user does not normally have sufficient privileges to execute.

Affected configurations

NVD

Node

lenovonextscale_n1200_enclosure_firmwareRange<fhet60b-3.40

AND

lenovonextscale_n1200_enclosureMatch-

Node

lenovothinkagile_cp-cb-10_firmwareRange<tesm38c-1.26

AND

lenovothinkagile_cp-cb-10Match-

Node

lenovothinkagile_cp-cb-10e_firmwareRange<tesm38c-1.26

AND

lenovothinkagile_cp-cb-10eMatch-

Node

lenovothinkagile_hx_enclosure_certified_node_firmwareRange<tesm38c-1.26

AND

lenovothinkagile_hx_enclosure_certified_nodeMatch-

Node

lenovothinkagile_vx_enclosure_firmwareRange<tesm38c-1.26

AND

lenovothinkagile_vx_enclosureMatch-

Node

lenovothinksystem_d2_enclosure_firmwareRange<tesm38c-1.26

AND

lenovothinksystem_d2_enclosureMatch-

Node

lenovothinksystem_da240_enclosure_firmwareRange<umsm10s-1.07

AND

lenovothinksystem_da240_enclosureMatch-

Node

lenovothinksystem_dw612_enclosure_firmwareRange<umsm10s-1.07

AND

lenovothinksystem_dw612_enclosureMatch-

CPENameOperatorVersion
lenovo:nextscale_n1200_enclosure_firmwarelenovo nextscale n1200 enclosure firmwareltfhet60b-3.40

CPE	Name	Operator	Version
lenovo:nextscale_n1200_enclosure_firmware	lenovo nextscale n1200 enclosure firmware	lt	fhet60b-3.40

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "System Management Module (SMM) ",
    "vendor": "Lenovo",
    "versions": [
      {
        "status": "affected",
        "version": "various"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "Fan Power Controller (FPC)",
    "vendor": "Lenovo",
    "versions": [
      {
        "status": "affected",
        "version": "various"
      }
    ]
  }
]

References

support.lenovo.com/us/en/product_security/LEN-127357

6.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

6.4 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

13.5%

JSON

Related for CVE-2023-2993

prion1 nvd1 cvelist1