PT-2013-4514 · Supermicro · Supermicro Ipmi

Published 2013-09-08 · Updated 2017-11-15 · CVE-2013-3609

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Supermicro IPMI implementation versions (affected versions not specified)

Description The issue concerns the web interface in the Intelligent Platform Management Interface (IPMI) implementation, where authorization checks rely on JavaScript code on the client. This allows remote authenticated users to bypass intended access restrictions via a crafted request, related to the PrivilegeCallBack function.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2013-3609

Affected Products

Supermicro Ipmi

References · 7

• 🔥 https://usenix.org/system/files/conference/woot13/woot13-bonkoski_0.pdf · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2013-3609 · Security Note
• http://securityfocus.com/bid/62098 · Note
• http://kb.cert.org/vuls/id/648646 · Note
• https://support.citrix.com/article/CTX216642 · Note
• http://thomas-krenn.com/en/wiki/Supermicro_IPMI_Security_Updates_November_2013 · Note
• http://supermicro.com/products/nfo/files/IPMI/CVE_Update.pdf · Note