PT-2023-5854 · Supermicro · Supermicro X11Sae-F+1

Published

2023-08-17

·

Updated

2025-06-18

·

CVE-2023-40287

CVSS v3.1

8.3

High

VectorAV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Supermicro X11SSM-F version 1.66 Supermicro X11SAE-F version 1.66 Supermicro X11SSE-F version 1.66
Description An issue was discovered in the web interface of Supermicro X11 series devices, specifically X11SSM-F, X11SAE-F, and X11SSE-F, due to inadequate protection of the web page structure. This issue could allow a remote attacker to conduct a cross-site scripting (XSS) attack using a specially crafted GET request.
Recommendations For Supermicro X11SSM-F version 1.66, consider disabling access to the web interface until a patch is available. For Supermicro X11SAE-F version 1.66, restrict access to the BMC IPMI server to minimize the risk of exploitation. For Supermicro X11SSE-F version 1.66, avoid using the web interface for sensitive operations until the issue is resolved. As a temporary workaround, consider implementing additional security measures, such as input validation and output encoding, to prevent XSS attacks.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2023-06541
CVE-2023-40287

Affected Products

Supermicro X11Sae-F
Supermicro X11Sse-F