Lucene search

IbmCVELIST:CVE-2024-31916

HistoryJun 27, 2024 - 5:45 p.m.

CVE-2024-31916 IBM OpenBMC information disclosure

2024-06-2717:45:31

CWE-288

ibm

www.cve.org

ibm

openbmc

fw1050.00-fw1050.10

information disclosure

bmcweb

https

authentication channels

x-forceid

290026

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.001

Percentile

32.5%

JSON

IBM OpenBMC FW1050.00 through FW1050.10 BMCWeb HTTPS server component could disclose sensitive URI content to an unauthorized actor that bypasses authentication channels. IBM X-ForceID: 290026.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "OpenBMC",
    "vendor": "IBM",
    "versions": [
      {
        "lessThanOrEqual": "FW1050.10",
        "status": "affected",
        "version": "FW1050.00",
        "versionType": "semver"
      }
    ]
  }
]

References

exchange.xforce.ibmcloud.com/vulnerabilities/290026

www.ibm.com/support/pages/node/7158679

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.001

Percentile

32.5%

JSON

Related for CVELIST:CVE-2024-31916