CVE-2019-19642

Опубликовано: 08 дек. 2019

Источник: nvd

CVSS3: 8.8

CVSS2: 9

EPSS Средний

Описание

On SuperMicro X8STi-F motherboards with IPMI firmware 2.06 and BIOS 02.68, the Virtual Media feature allows OS Command Injection by authenticated attackers who can send HTTP requests to the IPMI IP address. This requires a POST to /rpc/setvmdrive.asp with shell metacharacters in ShareHost or ShareName. The attacker can achieve a persistent backdoor.

Ссылки

https://www.dark-sec.net/2019/12/supermicro-ipmi-exploitation.html
Exploit
Third Party Advisory
https://www.dark-sec.net/2019/12/supermicro-ipmi-exploitation.html
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одновременно

Одно из

cpe:2.3:o:supermicro:x8sti-f_bios:02.68:*:*:*:*:*:*:*

cpe:2.3:o:supermicro:x8sti-f_firmware:2.06:*:*:*:*:*:*:*

cpe:2.3:h:supermicro:x8sti-f:-:*:*:*:*:*:*:*

EPSS

Процентиль: 96%

0.25951

Средний

8.8 High

CVSS3

9 Critical

CVSS2

Дефекты

CWE-78

Связанные уязвимости

GHSA-8rgw-25fw-5m5f

github

больше 3 лет назад