admin/cvelist
1
0
Fork 0
mirror of https://github.com/CVEProject/cvelist.git synced 2025-07-30 18:04:30 +00:00
Code Issues Packages Projects Releases Wiki Activity

- Added submission from Lenovo for LEN-20227 from 2018-07-26

Browse Source
This commit is contained in:
CVE Team 2018-07-26 14:18:01 -04:00
parent a87e749083
commit 63fd9e0008
No known key found for this signature in database
GPG Key ID: 0DA1F9F56BC892E8
1 changed files with 63 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

66
2018/9xxx/CVE-2018-9068.json
View File

@ -1,8 +1,49 @@
{
"CVE_data_meta" : {
"ASSIGNER" : "cve@mitre.org",
"ASSIGNER" : "psirt@lenovo.com",
"DATE_PUBLIC" : "2018-07-26T00:00:00",
"ID" : "CVE-2018-9068",
"STATE" : "RESERVED"
"STATE" : "PUBLIC"
},
"affects" : {
"vendor" : {
"vendor_data" : [
{
"product" : {
"product_data" : [
{
"product_name" : "System x IMM2",
"version" : {
"version_data" : [
{
"version_value" : "firmware versions earlier than 4.90"
}
]
}
}
]
},
"vendor_name" : "Lenovo Group Ltd."
},
{
"product" : {
"product_data" : [
{
"product_name" : "System x IMM2",
"version" : {
"version_data" : [
{
"version_value" : "firmware versions earlier than 6.80"
}
]
}
}
]
},
"vendor_name" : "IBM Corporation"
}
]
}
},
"data_format" : "MITRE",
"data_type" : "CVE",
@ -11,7 +52,26 @@
"description_data" : [
{
"lang" : "eng",
"value" : "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
"value" : "The IMM2 First Failure Data Capture function collects management module logs and diagnostic information when a hardware error is detected. This information is made available for download through an SFTP server hosted on the IMM2 management network interface. In versions earlier than 4.90 for Lenovo System x and earlier than 6.80 for IBM System x, the credentials to access the SFTP server are hard-coded and described in the IMM2 documentation, allowing an attacker with management network access to obtain the collected FFDC data. After applying the update, the IMM2 will create random SFTP credentials for use with OneCLI."
}
]
},
"problemtype" : {
"problemtype_data" : [
{
"description" : [
{
"lang" : "eng",
"value" : "Information disclosure"
}
]
}
]
},
"references" : {
"reference_data" : [
{
"url" : "https://support.lenovo.com/us/en/solutions/LEN-20227"
}
]
}