nvd-json-data-feeds/CVE-2021/CVE-2021-38xx/CVE-2021-3849.json

{
  "id": "CVE-2021-3849",
  "sourceIdentifier": "psirt@lenovo.com",
  "published": "2022-04-22T21:15:09.557",
  "lastModified": "2022-10-27T11:55:52.653",
  "vulnStatus": "Analyzed",
  "descriptions": [
    {
      "lang": "en",
      "value": "An authentication bypass vulnerability was discovered in the web interface of the Lenovo Fan Power Controller2 (FPC2) and Lenovo System Management Module (SMM) firmware that could allow an unauthenticated attacker to execute commands on the SMM and FPC2. SMM2 is not affected."
    },
    {
      "lang": "es",
      "value": "Se ha detectado una vulnerabilidad de omisi\u00f3n de autenticaci\u00f3n en la interfaz web del firmware de Lenovo Fan Power Controller2 (FPC2) y Lenovo System Management Module (SMM) que podr\u00eda permitir a un atacante no autenticado ejecutar comandos en el SMM y el FPC2. SMM2 no est\u00e1 afectado"
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "nvd@nist.gov",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9
      },
      {
        "source": "psirt@lenovo.com",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9
      }
    ],
    "cvssMetricV2": [
      {
        "source": "nvd@nist.gov",
        "type": "Primary",
        "cvssData": {
          "version": "2.0",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "accessVector": "NETWORK",
          "accessComplexity": "LOW",
          "authentication": "NONE",
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "availabilityImpact": "PARTIAL",
          "baseScore": 7.5
        },
        "baseSeverity": "HIGH",
        "exploitabilityScore": 10.0,
        "impactScore": 6.4,
        "acInsufInfo": false,
        "obtainAllPrivilege": false,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "weaknesses": [
    {
      "source": "nvd@nist.gov",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    },
    {
      "source": "psirt@lenovo.com",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-288"
        }
      ]
    }
  ],
  "configurations": [
    {
      "operator": "AND",
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:lenovo:nextscale_n1200_enclosure_firmware:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "fhet50b-2.90",
              "matchCriteriaId": "0EAD582C-E91B-4835-AA1B-E5213A407D30"
            }
          ]
        },
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": false,
              "criteria": "cpe:2.3:h:lenovo:nextscale_n1200_enclosure:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "21BACC24-DDE4-4016-97DE-60C51E5F1AC6"
            }
          ]
        }
      ]
    },
    {
      "operator": "AND",
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:lenovo:thinkagile_hx_enclosure_certified_node_firmware:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "tesm28b-1.21",
              "matchCriteriaId": "6FAD1959-ABD8-425A-BFF9-72855654BFA0"
            }
          ]
        },
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": false,
              "criteria": "cpe:2.3:h:lenovo:thinkagile_hx_enclosure_certified_node:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "41B43352-1245-46E2-A167-47B2E629BFA7"
            }
          ]
        }
      ]
    },
    {
      "operator": "AND",
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:lenovo:thinkagile_vx_enclosure_firmware:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "tesm28b-1.21",
              "matchCriteriaId": "AAB1480F-BD40-4C75-AF46-C0AF99B45012"
            }
          ]
        },
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": false,
              "criteria": "cpe:2.3:h:lenovo:thinkagile_vx_enclosure:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "C425D71A-19B5-4983-B95C-B5CB6EB7C065"
            }
          ]
        }
      ]
    },
    {
      "operator": "AND",
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:lenovo:thinksystem_d2_enclosure_firmware:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "tesm28b-1.21",
              "matchCriteriaId": "E4F65776-CCF4-40A8-934F-E41056A258F5"
            }
          ]
        },
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": false,
              "criteria": "cpe:2.3:h:lenovo:thinksystem_d2_enclosure:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "8A78D856-B4DF-4B79-9901-434AE6FCE240"
            }
          ]
        }
      ]
    },
    {
      "operator": "AND",
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:ibm:nextscale_fan_power_controller_firmware:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "44a-3.70",
              "matchCriteriaId": "CBA4E681-6674-424F-89F6-7DA9156549F4"
            }
          ]
        },
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": false,
              "criteria": "cpe:2.3:h:ibm:nextscale_fan_power_controller:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "493DD621-E61D-42FC-ADB3-0AEA67E873A2"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://support.lenovo.com/us/en/product_security/LEN-72615",
      "source": "psirt@lenovo.com",
      "tags": [
        "Vendor Advisory"
      ]
    }
  ]
}