PT-2013-4514 · Supermicro · Supermicro Ipmi

Publicado 2013-09-08 · Atualizado 2017-11-15 · CVE-2013-3609

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Supermicro IPMI implementation versions (affected versions not specified)

Description The issue concerns the web interface in the Intelligent Platform Management Interface (IPMI) implementation, where authorization checks rely on JavaScript code on the client. This allows remote authenticated users to bypass intended access restrictions via a crafted request, related to the PrivilegeCallBack function.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2013-3609

Produtos afetados

Supermicro Ipmi

Referências · 7

• 🔥 https://usenix.org/system/files/conference/woot13/woot13-bonkoski_0.pdf · Exploit
• http://securityfocus.com/bid/62098 · Nota
• http://kb.cert.org/vuls/id/648646 · Nota
• https://support.citrix.com/article/CTX216642 · Nota
• http://thomas-krenn.com/en/wiki/Supermicro_IPMI_Security_Updates_November_2013 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2013-3609 · Nota de Segurança
• http://supermicro.com/products/nfo/files/IPMI/CVE_Update.pdf · Nota