PT-2024-24280 · Ibm · Ibm Openbmc

Published 2024-06-27 · Updated 2024-08-06 · CVE-2024-31916

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM OpenBMC versions FW1050.00 through FW1050.10

Description The BMCWeb HTTPS server component in IBM OpenBMC could disclose sensitive URI content to an unauthorized actor that bypasses authentication channels.

Recommendations For versions FW1050.00 through FW1050.10, update to a version that fixes this issue to prevent unauthorized access to sensitive URI content.

Fix

Missing Authentication

Authentication Bypass Using an Alternate Path or Channel

Weakness Enumeration

CWE-306

CWE-288

Related Identifiers

CVE-2024-31916

Affected Products

Ibm Openbmc

References · 4

• https://osv.dev/vulnerability/CVE-2024-31916 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-31916 · Security Note
• https://ibm.com/support/pages/node/7158679 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/290026 · Vendor Advisory