Search

Find a vulnerability

Search criteria

    4 vulnerabilities found for Chassis Management Module (CMM) by Lenovo

    CVE-2018-9073 (GCVE-0-2018-9073)

    Vulnerability from nvd – Published: 2018-11-16 14:00 – Updated: 2024-08-05 07:17
    VLAI
    Title
    CMM Security Vulnerability
    Summary
    Lenovo Chassis Management Module (CMM) prior to version 2.0.0 utilizes a hardcoded encryption key to protect certain secrets. Possession of the key can allow an attacker that has already compromised the server to decrypt these secrets.
    Severity
    No CVSS data available.
    CWE
    • Hardcoded Encryption Key
    Assigner
    References
    Impacted products
    Vendor Product Version
    Lenovo Chassis Management Module (CMM) Affected: unspecified , < 2.0.0 (custom)
    		Create a notification for this product.
    Date Public
    2018-11-16 00:00
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T07:17:50.603Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://support.lenovo.com/us/en/solutions/LEN-23806"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Chassis Management Module (CMM)",
          "vendor": "Lenovo",
          "versions": [
            {
              "lessThan": "2.0.0",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2018-11-16T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Lenovo Chassis Management Module (CMM) prior to version 2.0.0 utilizes a hardcoded encryption key to protect certain secrets. Possession of the key can allow an attacker that has already compromised the server to decrypt these secrets."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Hardcoded Encryption Key",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-11-16T13:57:01.000Z",
        "orgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b",
        "shortName": "lenovo"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://support.lenovo.com/us/en/solutions/LEN-23806"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Update to CMM v 2.0.0 or higher"
        }
      ],
      "source": {
        "advisory": "LEN-23806",
        "discovery": "INTERNAL"
      },
      "title": "CMM Security Vulnerability",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@lenovo.com",
          "ID": "CVE-2018-9073",
          "STATE": "PUBLIC",
          "TITLE": "CMM Security Vulnerability"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Chassis Management Module (CMM)",
                      "version": {
                        "version_data": [
                          {
                            "affected": "\u003c",
                            "version_affected": "\u003c",
                            "version_value": "2.0.0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Lenovo"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Lenovo Chassis Management Module (CMM) prior to version 2.0.0 utilizes a hardcoded encryption key to protect certain secrets. Possession of the key can allow an attacker that has already compromised the server to decrypt these secrets."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Hardcoded Encryption Key"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://support.lenovo.com/us/en/solutions/LEN-23806",
              "refsource": "CONFIRM",
              "url": "https://support.lenovo.com/us/en/solutions/LEN-23806"
            }
          ]
        },
        "solution": [
          {
            "lang": "en",
            "value": "Update to CMM v 2.0.0 or higher"
          }
        ],
        "source": {
          "advisory": "LEN-23806",
          "discovery": "INTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b",
    "assignerShortName": "lenovo",
    "cveId": "CVE-2018-9073",
    "datePublished": "2018-11-16T14:00:00.000Z",
    "dateReserved": "2018-03-27T00:00:00.000Z",
    "dateUpdated": "2024-08-05T07:17:50.603Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2018-9071 (GCVE-0-2018-9071)

    Vulnerability from nvd – Published: 2018-11-16 14:00 – Updated: 2024-08-05 07:17
    VLAI
    Title
    CMM Security Vulnerability
    Summary
    Lenovo Chassis Management Module (CMM) prior to version 2.0.0 allows unauthenticated users to retrieve information related to the current authentication configuration settings. Exposed settings relate to password lengths, expiration, and lockout configuration.
    Severity
    No CVSS data available.
    CWE
    • Information Disclosure
    Assigner
    References
    Impacted products
    Vendor Product Version
    Lenovo Chassis Management Module (CMM) Affected: unspecified , < 2.0.0 (custom)
    		Create a notification for this product.
    Date Public
    2018-11-16 00:00
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T07:17:50.339Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://support.lenovo.com/us/en/solutions/LEN-23806"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Chassis Management Module (CMM)",
          "vendor": "Lenovo",
          "versions": [
            {
              "lessThan": "2.0.0",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2018-11-16T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Lenovo Chassis Management Module (CMM) prior to version 2.0.0 allows unauthenticated users to retrieve information related to the current authentication configuration settings. Exposed settings relate to password lengths, expiration, and lockout configuration."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Information Disclosure",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-11-16T13:57:01.000Z",
        "orgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b",
        "shortName": "lenovo"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://support.lenovo.com/us/en/solutions/LEN-23806"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Update to CMM v 2.0.0 or higher"
        }
      ],
      "source": {
        "advisory": "LEN-23806",
        "discovery": "INTERNAL"
      },
      "title": "CMM Security Vulnerability",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@lenovo.com",
          "ID": "CVE-2018-9071",
          "STATE": "PUBLIC",
          "TITLE": "CMM Security Vulnerability"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Chassis Management Module (CMM)",
                      "version": {
                        "version_data": [
                          {
                            "affected": "\u003c",
                            "version_affected": "\u003c",
                            "version_value": "2.0.0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Lenovo"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Lenovo Chassis Management Module (CMM) prior to version 2.0.0 allows unauthenticated users to retrieve information related to the current authentication configuration settings. Exposed settings relate to password lengths, expiration, and lockout configuration."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Information Disclosure"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://support.lenovo.com/us/en/solutions/LEN-23806",
              "refsource": "CONFIRM",
              "url": "https://support.lenovo.com/us/en/solutions/LEN-23806"
            }
          ]
        },
        "solution": [
          {
            "lang": "en",
            "value": "Update to CMM v 2.0.0 or higher"
          }
        ],
        "source": {
          "advisory": "LEN-23806",
          "discovery": "INTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b",
    "assignerShortName": "lenovo",
    "cveId": "CVE-2018-9071",
    "datePublished": "2018-11-16T14:00:00.000Z",
    "dateReserved": "2018-03-27T00:00:00.000Z",
    "dateUpdated": "2024-08-05T07:17:50.339Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2018-9071 (GCVE-0-2018-9071)

    Vulnerability from cvelistv5 – Published: 2018-11-16 14:00 – Updated: 2024-08-05 07:17
    VLAI
    Title
    CMM Security Vulnerability
    Summary
    Lenovo Chassis Management Module (CMM) prior to version 2.0.0 allows unauthenticated users to retrieve information related to the current authentication configuration settings. Exposed settings relate to password lengths, expiration, and lockout configuration.
    Severity
    No CVSS data available.
    CWE
    • Information Disclosure
    Assigner
    References
    Impacted products
    Vendor Product Version
    Lenovo Chassis Management Module (CMM) Affected: unspecified , < 2.0.0 (custom)
    		Create a notification for this product.
    Date Public
    2018-11-16 00:00
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T07:17:50.339Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://support.lenovo.com/us/en/solutions/LEN-23806"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Chassis Management Module (CMM)",
          "vendor": "Lenovo",
          "versions": [
            {
              "lessThan": "2.0.0",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2018-11-16T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Lenovo Chassis Management Module (CMM) prior to version 2.0.0 allows unauthenticated users to retrieve information related to the current authentication configuration settings. Exposed settings relate to password lengths, expiration, and lockout configuration."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Information Disclosure",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-11-16T13:57:01.000Z",
        "orgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b",
        "shortName": "lenovo"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://support.lenovo.com/us/en/solutions/LEN-23806"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Update to CMM v 2.0.0 or higher"
        }
      ],
      "source": {
        "advisory": "LEN-23806",
        "discovery": "INTERNAL"
      },
      "title": "CMM Security Vulnerability",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@lenovo.com",
          "ID": "CVE-2018-9071",
          "STATE": "PUBLIC",
          "TITLE": "CMM Security Vulnerability"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Chassis Management Module (CMM)",
                      "version": {
                        "version_data": [
                          {
                            "affected": "\u003c",
                            "version_affected": "\u003c",
                            "version_value": "2.0.0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Lenovo"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Lenovo Chassis Management Module (CMM) prior to version 2.0.0 allows unauthenticated users to retrieve information related to the current authentication configuration settings. Exposed settings relate to password lengths, expiration, and lockout configuration."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Information Disclosure"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://support.lenovo.com/us/en/solutions/LEN-23806",
              "refsource": "CONFIRM",
              "url": "https://support.lenovo.com/us/en/solutions/LEN-23806"
            }
          ]
        },
        "solution": [
          {
            "lang": "en",
            "value": "Update to CMM v 2.0.0 or higher"
          }
        ],
        "source": {
          "advisory": "LEN-23806",
          "discovery": "INTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b",
    "assignerShortName": "lenovo",
    "cveId": "CVE-2018-9071",
    "datePublished": "2018-11-16T14:00:00.000Z",
    "dateReserved": "2018-03-27T00:00:00.000Z",
    "dateUpdated": "2024-08-05T07:17:50.339Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2018-9073 (GCVE-0-2018-9073)

    Vulnerability from cvelistv5 – Published: 2018-11-16 14:00 – Updated: 2024-08-05 07:17
    VLAI
    Title
    CMM Security Vulnerability
    Summary
    Lenovo Chassis Management Module (CMM) prior to version 2.0.0 utilizes a hardcoded encryption key to protect certain secrets. Possession of the key can allow an attacker that has already compromised the server to decrypt these secrets.
    Severity
    No CVSS data available.
    CWE
    • Hardcoded Encryption Key
    Assigner
    References
    Impacted products
    Vendor Product Version
    Lenovo Chassis Management Module (CMM) Affected: unspecified , < 2.0.0 (custom)
    		Create a notification for this product.
    Date Public
    2018-11-16 00:00
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T07:17:50.603Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://support.lenovo.com/us/en/solutions/LEN-23806"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Chassis Management Module (CMM)",
          "vendor": "Lenovo",
          "versions": [
            {
              "lessThan": "2.0.0",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2018-11-16T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Lenovo Chassis Management Module (CMM) prior to version 2.0.0 utilizes a hardcoded encryption key to protect certain secrets. Possession of the key can allow an attacker that has already compromised the server to decrypt these secrets."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Hardcoded Encryption Key",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-11-16T13:57:01.000Z",
        "orgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b",
        "shortName": "lenovo"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://support.lenovo.com/us/en/solutions/LEN-23806"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Update to CMM v 2.0.0 or higher"
        }
      ],
      "source": {
        "advisory": "LEN-23806",
        "discovery": "INTERNAL"
      },
      "title": "CMM Security Vulnerability",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@lenovo.com",
          "ID": "CVE-2018-9073",
          "STATE": "PUBLIC",
          "TITLE": "CMM Security Vulnerability"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Chassis Management Module (CMM)",
                      "version": {
                        "version_data": [
                          {
                            "affected": "\u003c",
                            "version_affected": "\u003c",
                            "version_value": "2.0.0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Lenovo"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Lenovo Chassis Management Module (CMM) prior to version 2.0.0 utilizes a hardcoded encryption key to protect certain secrets. Possession of the key can allow an attacker that has already compromised the server to decrypt these secrets."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Hardcoded Encryption Key"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://support.lenovo.com/us/en/solutions/LEN-23806",
              "refsource": "CONFIRM",
              "url": "https://support.lenovo.com/us/en/solutions/LEN-23806"
            }
          ]
        },
        "solution": [
          {
            "lang": "en",
            "value": "Update to CMM v 2.0.0 or higher"
          }
        ],
        "source": {
          "advisory": "LEN-23806",
          "discovery": "INTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b",
    "assignerShortName": "lenovo",
    "cveId": "CVE-2018-9073",
    "datePublished": "2018-11-16T14:00:00.000Z",
    "dateReserved": "2018-03-27T00:00:00.000Z",
    "dateUpdated": "2024-08-05T07:17:50.603Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}