NVD

Id
39376  
Name
CVE-2013-3609  
Description
The web interface in the Intelligent Platform Management Interface (IPMI) implementation on Supermicro H8DC*, H8DG*, H8SCM-F, H8SGL-F, H8SM*, X7SP*, X8DT*, X8SI*, X9DAX-*, X9DB*, X9DR*, X9QR*, X9SBAA-F, X9SC*, X9SPU-F, and X9SR* devices relies on JavaScript code on the client for authorization checks, which allows remote authenticated users to bypass intended access restrictions via a crafted request, related to the PrivilegeCallBack function.  
Reject
 
CVSS Version
2  
CVSS Score
10  
Severity
High  
CVSS Base Score
10  
CVSS Impact Subscore
10  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:C/I:C/A:C)  
Pub Date
2017-01-18  
Published
2013-09-07  
Modified Date
2016-11-28  
Seq
2013-3609  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
200868 39376 CVE-2013-3609 VU#648646  View
200869 39376 CVE-2013-3609 62098  View
200870 39376 CVE-2013-3609 http://www.supermicro.com/products/nfo/files/IPMI/CVE_Update.pdf  View
200871 39376 CVE-2013-3609 http://www.thomas-krenn.com/en/wiki/Supermicro_IPMI_Security_Updates_November_2013  View
200872 39376 CVE-2013-3609 https://www.usenix.org/system/files/conference/woot13/woot13-bonkoski_0.pdf  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
22419 JVNDB-2013-003994 複数の Supermicro デバイス製品の IPMI におけるアクセス制限を回避される脆弱性 複数の Supermicro デバイス製品の Intelligent Platform Management Interface (IPMI) が実装する Web インターフェースは、認証チェックのために使用されるクライアント上の JavaScript コードを信頼するため、アクセス制限を回避される脆弱性が存在します。 CVE-2013-3609 63551 CVE-2013-3609 39376 10 http://jvndb.jvn.jp/ja/contents/2013/JVNDB-2013-003994.html 2013-08-30 2013-12-26 View