Search
Find a vulnerability
Search criteria
20 vulnerabilities found for x11sae-f_firmware by supermicro
CVE-2023-40290 (GCVE-0-2023-40290)
Vulnerability from nvd – Published: 2024-03-27 00:00 – Updated: 2024-10-28 16:04
VLAI
Summary
An issue was discovered on Supermicro X11SSM-F, X11SAE-F, and X11SSE-F 1.66 devices. An attacker could exploit an XSS issue that affects Internet Explorer 11 on Windows.
Severity
8.3 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- n/a
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| supermicro | x11ssm-f_firmware |
Affected:
1.66
cpe:2.3:o:supermicro:x11ssm-f_firmware:*:*:*:*:*:*:*:* |
|
| supermicro | x11sae-f_firmware |
Affected:
1.66
cpe:2.3:o:supermicro:x11sae-f_firmware:*:*:*:*:*:*:*:* |
|
| supermicro | x11sse-f_firmware |
Affected:
1.66
cpe:2.3:o:supermicro:x11sse-f_firmware:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T18:31:52.925Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.supermicro.com/en/support/security_center#%21advisories"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.supermicro.com/en/support/security_BMC_IPMI_Oct_2023"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:o:supermicro:x11ssm-f_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "x11ssm-f_firmware",
"vendor": "supermicro",
"versions": [
{
"status": "affected",
"version": "1.66"
}
]
},
{
"cpes": [
"cpe:2.3:o:supermicro:x11sae-f_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "x11sae-f_firmware",
"vendor": "supermicro",
"versions": [
{
"status": "affected",
"version": "1.66"
}
]
},
{
"cpes": [
"cpe:2.3:o:supermicro:x11sse-f_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "x11sse-f_firmware",
"vendor": "supermicro",
"versions": [
{
"status": "affected",
"version": "1.66"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2023-40290",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-06T15:39:43.935912Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-10-28T16:04:49.590Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered on Supermicro X11SSM-F, X11SAE-F, and X11SSE-F 1.66 devices. An attacker could exploit an XSS issue that affects Internet Explorer 11 on Windows."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-03-27T03:27:16.669Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://www.supermicro.com/en/support/security_center#%21advisories"
},
{
"url": "https://www.supermicro.com/en/support/security_BMC_IPMI_Oct_2023"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2023-40290",
"datePublished": "2024-03-27T00:00:00.000Z",
"dateReserved": "2023-08-14T00:00:00.000Z",
"dateUpdated": "2024-10-28T16:04:49.590Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-40289 (GCVE-0-2023-40289)
Vulnerability from nvd – Published: 2024-03-27 00:00 – Updated: 2024-08-06 14:58
VLAI
Summary
A command injection issue was discovered on Supermicro X11SSM-F, X11SAE-F, and X11SSE-F 1.66 devices. An attacker can exploit this to elevate privileges from a user with BMC administrative privileges.
Severity
7.2 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- n/a
- CWE-269 - Improper Privilege Management
Assigner
References
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| supermicro | x11ssm-f |
Affected:
1.66
cpe:2.3:h:supermicro:x11ssm-f:-:*:*:*:*:*:*:* |
|
| supermicro | x11sae-f |
Affected:
1.66
cpe:2.3:h:supermicro:x11sae-f:-:*:*:*:*:*:*:* |
|
| supermicro | x11sse-f |
Affected:
1.66
cpe:2.3:h:supermicro:x11sse-f:-:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T18:31:52.795Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.supermicro.com/en/support/security_center#%21advisories"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.supermicro.com/en/support/security_BMC_IPMI_Oct_2023"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:h:supermicro:x11ssm-f:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "x11ssm-f",
"vendor": "supermicro",
"versions": [
{
"status": "affected",
"version": "1.66"
}
]
},
{
"cpes": [
"cpe:2.3:h:supermicro:x11sae-f:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "x11sae-f",
"vendor": "supermicro",
"versions": [
{
"status": "affected",
"version": "1.66"
}
]
},
{
"cpes": [
"cpe:2.3:h:supermicro:x11sse-f:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "x11sse-f",
"vendor": "supermicro",
"versions": [
{
"status": "affected",
"version": "1.66"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2023-40289",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-06T14:51:43.218678Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "CWE-269 Improper Privilege Management",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-08-06T14:58:54.338Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A command injection issue was discovered on Supermicro X11SSM-F, X11SAE-F, and X11SSE-F 1.66 devices. An attacker can exploit this to elevate privileges from a user with BMC administrative privileges."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-03-27T03:25:53.042Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://www.supermicro.com/en/support/security_center#%21advisories"
},
{
"url": "https://www.supermicro.com/en/support/security_BMC_IPMI_Oct_2023"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2023-40289",
"datePublished": "2024-03-27T00:00:00.000Z",
"dateReserved": "2023-08-14T00:00:00.000Z",
"dateUpdated": "2024-08-06T14:58:54.338Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-40288 (GCVE-0-2023-40288)
Vulnerability from nvd – Published: 2024-03-27 00:00 – Updated: 2024-08-05 14:47
VLAI
Summary
An issue was discovered on Supermicro X11SSM-F, X11SAE-F, and X11SSE-F 1.66 devices. An attacker could exploit an XSS issue.
Severity
8.3 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- n/a
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| supermicro | x11ssm-f_firmware |
Affected:
1.66
cpe:2.3:o:supermicro:x11ssm-f_firmware:1.66:*:*:*:*:*:*:* |
|
| supermicro | x11sae-f_firmware |
Affected:
1.66
cpe:2.3:o:supermicro:x11sae-f_firmware:1.66:*:*:*:*:*:*:* |
|
| supermicro | x11sse-f_firmware |
Affected:
1.66
cpe:2.3:o:supermicro:x11sse-f_firmware:1.66:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T18:31:53.014Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.supermicro.com/en/support/security_center#%21advisories"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.supermicro.com/en/support/security_BMC_IPMI_Oct_2023"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:o:supermicro:x11ssm-f_firmware:1.66:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "x11ssm-f_firmware",
"vendor": "supermicro",
"versions": [
{
"status": "affected",
"version": "1.66"
}
]
},
{
"cpes": [
"cpe:2.3:o:supermicro:x11sae-f_firmware:1.66:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "x11sae-f_firmware",
"vendor": "supermicro",
"versions": [
{
"status": "affected",
"version": "1.66"
}
]
},
{
"cpes": [
"cpe:2.3:o:supermicro:x11sse-f_firmware:1.66:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "x11sse-f_firmware",
"vendor": "supermicro",
"versions": [
{
"status": "affected",
"version": "1.66"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2023-40288",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-05T14:45:32.685977Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-08-05T14:47:37.423Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered on Supermicro X11SSM-F, X11SAE-F, and X11SSE-F 1.66 devices. An attacker could exploit an XSS issue."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-03-27T03:24:11.334Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://www.supermicro.com/en/support/security_center#%21advisories"
},
{
"url": "https://www.supermicro.com/en/support/security_BMC_IPMI_Oct_2023"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2023-40288",
"datePublished": "2024-03-27T00:00:00.000Z",
"dateReserved": "2023-08-14T00:00:00.000Z",
"dateUpdated": "2024-08-05T14:47:37.423Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-40287 (GCVE-0-2023-40287)
Vulnerability from nvd – Published: 2024-03-27 00:00 – Updated: 2024-08-05 14:45
VLAI
Summary
An issue was discovered on Supermicro X11SSM-F, X11SAE-F, and X11SSE-F 1.66 devices. An attacker could exploit an XSS issue.
Severity
8.3 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- n/a
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| supermicro | x11ssm-f_firmware |
Affected:
1.66
cpe:2.3:o:supermicro:x11ssm-f_firmware:1.66:*:*:*:*:*:*:* |
|
| supermicro | x11sae-f_firmware |
Affected:
1.66
cpe:2.3:o:supermicro:x11sae-f_firmware:1.66:*:*:*:*:*:*:* |
|
| supermicro | x11sse-f_firmware |
Affected:
1.66
cpe:2.3:o:supermicro:x11sse-f_firmware:1.66:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T18:31:53.258Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.supermicro.com/en/support/security_center#%21advisories"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.supermicro.com/en/support/security_BMC_IPMI_Oct_2023"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:o:supermicro:x11ssm-f_firmware:1.66:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "x11ssm-f_firmware",
"vendor": "supermicro",
"versions": [
{
"status": "affected",
"version": "1.66"
}
]
},
{
"cpes": [
"cpe:2.3:o:supermicro:x11sae-f_firmware:1.66:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "x11sae-f_firmware",
"vendor": "supermicro",
"versions": [
{
"status": "affected",
"version": "1.66"
}
]
},
{
"cpes": [
"cpe:2.3:o:supermicro:x11sse-f_firmware:1.66:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "x11sse-f_firmware",
"vendor": "supermicro",
"versions": [
{
"status": "affected",
"version": "1.66"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2023-40287",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-05T14:42:43.396894Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-08-05T14:45:07.159Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered on Supermicro X11SSM-F, X11SAE-F, and X11SSE-F 1.66 devices. An attacker could exploit an XSS issue."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-03-27T03:23:15.329Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://www.supermicro.com/en/support/security_center#%21advisories"
},
{
"url": "https://www.supermicro.com/en/support/security_BMC_IPMI_Oct_2023"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2023-40287",
"datePublished": "2024-03-27T00:00:00.000Z",
"dateReserved": "2023-08-14T00:00:00.000Z",
"dateUpdated": "2024-08-05T14:45:07.159Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-40286 (GCVE-0-2023-40286)
Vulnerability from nvd – Published: 2024-03-27 00:00 – Updated: 2024-08-03 19:24
VLAI
Summary
An issue was discovered on Supermicro X11SSM-F, X11SAE-F, and X11SSE-F 1.66 devices. An attacker could exploit an XSS issue.
Severity
8.3 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- n/a
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| supermicro | x11ssm-f_firmware |
Affected:
1.66
cpe:2.3:o:supermicro:x11ssm-f_firmware:1.66:*:*:*:*:*:*:* |
|
| supermicro | x11sae-f_firmware |
Affected:
1.66
cpe:2.3:o:supermicro:x11sae-f_firmware:1.66:*:*:*:*:*:*:* |
|
| supermicro | x11sse-f_firmware |
Affected:
1.66
cpe:2.3:o:supermicro:x11sse-f_firmware:1.66:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T18:31:52.761Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.supermicro.com/en/support/security_center#%21advisories"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.supermicro.com/en/support/security_BMC_IPMI_Oct_2023"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:o:supermicro:x11ssm-f_firmware:1.66:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "x11ssm-f_firmware",
"vendor": "supermicro",
"versions": [
{
"status": "affected",
"version": "1.66"
}
]
},
{
"cpes": [
"cpe:2.3:o:supermicro:x11sae-f_firmware:1.66:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "x11sae-f_firmware",
"vendor": "supermicro",
"versions": [
{
"status": "affected",
"version": "1.66"
}
]
},
{
"cpes": [
"cpe:2.3:o:supermicro:x11sse-f_firmware:1.66:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "x11sse-f_firmware",
"vendor": "supermicro",
"versions": [
{
"status": "affected",
"version": "1.66"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2023-40286",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-03T19:14:42.532402Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-08-03T19:24:37.036Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered on Supermicro X11SSM-F, X11SAE-F, and X11SSE-F 1.66 devices. An attacker could exploit an XSS issue."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-03-27T03:22:31.116Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://www.supermicro.com/en/support/security_center#%21advisories"
},
{
"url": "https://www.supermicro.com/en/support/security_BMC_IPMI_Oct_2023"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2023-40286",
"datePublished": "2024-03-27T00:00:00.000Z",
"dateReserved": "2023-08-14T00:00:00.000Z",
"dateUpdated": "2024-08-03T19:24:37.036Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-40285 (GCVE-0-2023-40285)
Vulnerability from nvd – Published: 2024-03-27 00:00 – Updated: 2024-12-06 21:16
VLAI
Summary
An issue was discovered on Supermicro X11SSM-F, X11SAE-F, and X11SSE-F 1.66 devices. An attacker could exploit an XSS issue.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- n/a
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T18:31:53.255Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.supermicro.com/en/support/security_center#%21advisories"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.supermicro.com/en/support/security_BMC_IPMI_Oct_2023"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2023-40285",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-06T18:49:32.947751Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-12-06T21:16:17.261Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered on Supermicro X11SSM-F, X11SAE-F, and X11SSE-F 1.66 devices. An attacker could exploit an XSS issue."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-03-27T03:27:56.913Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://www.supermicro.com/en/support/security_center#%21advisories"
},
{
"url": "https://www.supermicro.com/en/support/security_BMC_IPMI_Oct_2023"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2023-40285",
"datePublished": "2024-03-27T00:00:00.000Z",
"dateReserved": "2023-08-14T00:00:00.000Z",
"dateUpdated": "2024-12-06T21:16:17.261Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-40284 (GCVE-0-2023-40284)
Vulnerability from nvd – Published: 2024-03-27 00:00 – Updated: 2024-08-05 14:42
VLAI
Summary
An issue was discovered on Supermicro X11SSM-F, X11SAE-F, and X11SSE-F 1.66 devices. An attacker could exploit an XSS issue.
Severity
8.3 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- n/a
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| supermicro | x11ssm-f_firmware |
Affected:
1.66
cpe:2.3:o:supermicro:x11ssm-f_firmware:1.66:*:*:*:*:*:*:* |
|
| supermicro | x11sae-f_firmware |
Affected:
1.66
cpe:2.3:o:supermicro:x11sae-f_firmware:1.66:*:*:*:*:*:*:* |
|
| supermicro | x11sse-f_firmware |
Affected:
1.66
cpe:2.3:o:supermicro:x11sse-f_firmware:1.66:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T18:31:53.130Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.supermicro.com/en/support/security_center#%21advisories"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.supermicro.com/en/support/security_BMC_IPMI_Oct_2023"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:o:supermicro:x11ssm-f_firmware:1.66:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "x11ssm-f_firmware",
"vendor": "supermicro",
"versions": [
{
"status": "affected",
"version": "1.66"
}
]
},
{
"cpes": [
"cpe:2.3:o:supermicro:x11sae-f_firmware:1.66:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "x11sae-f_firmware",
"vendor": "supermicro",
"versions": [
{
"status": "affected",
"version": "1.66"
}
]
},
{
"cpes": [
"cpe:2.3:o:supermicro:x11sse-f_firmware:1.66:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "x11sse-f_firmware",
"vendor": "supermicro",
"versions": [
{
"status": "affected",
"version": "1.66"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2023-40284",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-05T14:35:02.050429Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-08-05T14:42:05.915Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered on Supermicro X11SSM-F, X11SAE-F, and X11SSE-F 1.66 devices. An attacker could exploit an XSS issue."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-03-27T03:20:31.196Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://www.supermicro.com/en/support/security_center#%21advisories"
},
{
"url": "https://www.supermicro.com/en/support/security_BMC_IPMI_Oct_2023"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2023-40284",
"datePublished": "2024-03-27T00:00:00.000Z",
"dateReserved": "2023-08-14T00:00:00.000Z",
"dateUpdated": "2024-08-05T14:42:05.915Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-33413 (GCVE-0-2023-33413)
Vulnerability from nvd – Published: 2023-12-07 00:00 – Updated: 2024-08-02 15:47
VLAI
Summary
The configuration functionality in the Intelligent Platform Management Interface (IPMI) baseboard management controller (BMC) implementation on Supermicro X11 and M11 based devices, with firmware versions through 3.17.02, allows remote authenticated users to execute arbitrary commands.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
2 references
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T15:47:05.256Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "http://supermicro.com"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.supermicro.com/en/support/security_BMC_Dec_2023"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The configuration functionality in the Intelligent Platform Management Interface (IPMI) baseboard management controller (BMC) implementation on Supermicro X11 and M11 based devices, with firmware versions through 3.17.02, allows remote authenticated users to execute arbitrary commands."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-12-07T17:11:13.528Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "http://supermicro.com"
},
{
"url": "https://www.supermicro.com/en/support/security_BMC_Dec_2023"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2023-33413",
"datePublished": "2023-12-07T00:00:00.000Z",
"dateReserved": "2023-05-22T00:00:00.000Z",
"dateUpdated": "2024-08-02T15:47:05.256Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-33412 (GCVE-0-2023-33412)
Vulnerability from nvd – Published: 2023-12-07 00:00 – Updated: 2024-08-02 15:47
VLAI
Summary
The web interface in the Intelligent Platform Management Interface (IPMI) baseboard management controller (BMC) implementation on Supermicro X11 and M11 based devices, with firmware versions before 3.17.02, allows remote authenticated users to execute arbitrary commands via a crafted request targeting vulnerable cgi endpoints.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
2 references
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T15:47:05.628Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "http://supermicro.com"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.supermicro.com/en/support/security_BMC_Dec_2023"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The web interface in the Intelligent Platform Management Interface (IPMI) baseboard management controller (BMC) implementation on Supermicro X11 and M11 based devices, with firmware versions before 3.17.02, allows remote authenticated users to execute arbitrary commands via a crafted request targeting vulnerable cgi endpoints."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-12-07T17:11:09.358Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "http://supermicro.com"
},
{
"url": "https://www.supermicro.com/en/support/security_BMC_Dec_2023"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2023-33412",
"datePublished": "2023-12-07T00:00:00.000Z",
"dateReserved": "2023-05-22T00:00:00.000Z",
"dateUpdated": "2024-08-02T15:47:05.628Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-33411 (GCVE-0-2023-33411)
Vulnerability from nvd – Published: 2023-12-07 00:00 – Updated: 2024-11-26 15:28
VLAI
Summary
A web server in the Intelligent Platform Management Interface (IPMI) baseboard management controller (BMC) implementation on Supermicro X11 and M11 based devices, with firmware versions up to 3.17.02, allows remote unauthenticated users to perform directory traversal, potentially disclosing sensitive information.
Severity
No CVSS data available.
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- n/a
Assigner
References
2 references
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T15:47:05.254Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "http://supermicro.com"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.supermicro.com/en/support/security_BMC_Dec_2023"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-33411",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-26T15:28:13.887741Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-26T15:28:31.828Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A web server in the Intelligent Platform Management Interface (IPMI) baseboard management controller (BMC) implementation on Supermicro X11 and M11 based devices, with firmware versions up to 3.17.02, allows remote unauthenticated users to perform directory traversal, potentially disclosing sensitive information."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-12-07T17:11:05.033Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "http://supermicro.com"
},
{
"url": "https://www.supermicro.com/en/support/security_BMC_Dec_2023"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2023-33411",
"datePublished": "2023-12-07T00:00:00.000Z",
"dateReserved": "2023-05-22T00:00:00.000Z",
"dateUpdated": "2024-11-26T15:28:31.828Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-40290 (GCVE-0-2023-40290)
Vulnerability from cvelistv5 – Published: 2024-03-27 00:00 – Updated: 2024-10-28 16:04
VLAI
Summary
An issue was discovered on Supermicro X11SSM-F, X11SAE-F, and X11SSE-F 1.66 devices. An attacker could exploit an XSS issue that affects Internet Explorer 11 on Windows.
Severity
8.3 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- n/a
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| supermicro | x11ssm-f_firmware |
Affected:
1.66
cpe:2.3:o:supermicro:x11ssm-f_firmware:*:*:*:*:*:*:*:* |
|
| supermicro | x11sae-f_firmware |
Affected:
1.66
cpe:2.3:o:supermicro:x11sae-f_firmware:*:*:*:*:*:*:*:* |
|
| supermicro | x11sse-f_firmware |
Affected:
1.66
cpe:2.3:o:supermicro:x11sse-f_firmware:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T18:31:52.925Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.supermicro.com/en/support/security_center#%21advisories"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.supermicro.com/en/support/security_BMC_IPMI_Oct_2023"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:o:supermicro:x11ssm-f_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "x11ssm-f_firmware",
"vendor": "supermicro",
"versions": [
{
"status": "affected",
"version": "1.66"
}
]
},
{
"cpes": [
"cpe:2.3:o:supermicro:x11sae-f_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "x11sae-f_firmware",
"vendor": "supermicro",
"versions": [
{
"status": "affected",
"version": "1.66"
}
]
},
{
"cpes": [
"cpe:2.3:o:supermicro:x11sse-f_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "x11sse-f_firmware",
"vendor": "supermicro",
"versions": [
{
"status": "affected",
"version": "1.66"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2023-40290",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-06T15:39:43.935912Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-10-28T16:04:49.590Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered on Supermicro X11SSM-F, X11SAE-F, and X11SSE-F 1.66 devices. An attacker could exploit an XSS issue that affects Internet Explorer 11 on Windows."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-03-27T03:27:16.669Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://www.supermicro.com/en/support/security_center#%21advisories"
},
{
"url": "https://www.supermicro.com/en/support/security_BMC_IPMI_Oct_2023"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2023-40290",
"datePublished": "2024-03-27T00:00:00.000Z",
"dateReserved": "2023-08-14T00:00:00.000Z",
"dateUpdated": "2024-10-28T16:04:49.590Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-40288 (GCVE-0-2023-40288)
Vulnerability from cvelistv5 – Published: 2024-03-27 00:00 – Updated: 2024-08-05 14:47
VLAI
Summary
An issue was discovered on Supermicro X11SSM-F, X11SAE-F, and X11SSE-F 1.66 devices. An attacker could exploit an XSS issue.
Severity
8.3 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- n/a
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| supermicro | x11ssm-f_firmware |
Affected:
1.66
cpe:2.3:o:supermicro:x11ssm-f_firmware:1.66:*:*:*:*:*:*:* |
|
| supermicro | x11sae-f_firmware |
Affected:
1.66
cpe:2.3:o:supermicro:x11sae-f_firmware:1.66:*:*:*:*:*:*:* |
|
| supermicro | x11sse-f_firmware |
Affected:
1.66
cpe:2.3:o:supermicro:x11sse-f_firmware:1.66:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T18:31:53.014Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.supermicro.com/en/support/security_center#%21advisories"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.supermicro.com/en/support/security_BMC_IPMI_Oct_2023"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:o:supermicro:x11ssm-f_firmware:1.66:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "x11ssm-f_firmware",
"vendor": "supermicro",
"versions": [
{
"status": "affected",
"version": "1.66"
}
]
},
{
"cpes": [
"cpe:2.3:o:supermicro:x11sae-f_firmware:1.66:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "x11sae-f_firmware",
"vendor": "supermicro",
"versions": [
{
"status": "affected",
"version": "1.66"
}
]
},
{
"cpes": [
"cpe:2.3:o:supermicro:x11sse-f_firmware:1.66:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "x11sse-f_firmware",
"vendor": "supermicro",
"versions": [
{
"status": "affected",
"version": "1.66"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2023-40288",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-05T14:45:32.685977Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-08-05T14:47:37.423Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered on Supermicro X11SSM-F, X11SAE-F, and X11SSE-F 1.66 devices. An attacker could exploit an XSS issue."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-03-27T03:24:11.334Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://www.supermicro.com/en/support/security_center#%21advisories"
},
{
"url": "https://www.supermicro.com/en/support/security_BMC_IPMI_Oct_2023"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2023-40288",
"datePublished": "2024-03-27T00:00:00.000Z",
"dateReserved": "2023-08-14T00:00:00.000Z",
"dateUpdated": "2024-08-05T14:47:37.423Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-40286 (GCVE-0-2023-40286)
Vulnerability from cvelistv5 – Published: 2024-03-27 00:00 – Updated: 2024-08-03 19:24
VLAI
Summary
An issue was discovered on Supermicro X11SSM-F, X11SAE-F, and X11SSE-F 1.66 devices. An attacker could exploit an XSS issue.
Severity
8.3 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- n/a
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| supermicro | x11ssm-f_firmware |
Affected:
1.66
cpe:2.3:o:supermicro:x11ssm-f_firmware:1.66:*:*:*:*:*:*:* |
|
| supermicro | x11sae-f_firmware |
Affected:
1.66
cpe:2.3:o:supermicro:x11sae-f_firmware:1.66:*:*:*:*:*:*:* |
|
| supermicro | x11sse-f_firmware |
Affected:
1.66
cpe:2.3:o:supermicro:x11sse-f_firmware:1.66:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T18:31:52.761Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.supermicro.com/en/support/security_center#%21advisories"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.supermicro.com/en/support/security_BMC_IPMI_Oct_2023"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:o:supermicro:x11ssm-f_firmware:1.66:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "x11ssm-f_firmware",
"vendor": "supermicro",
"versions": [
{
"status": "affected",
"version": "1.66"
}
]
},
{
"cpes": [
"cpe:2.3:o:supermicro:x11sae-f_firmware:1.66:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "x11sae-f_firmware",
"vendor": "supermicro",
"versions": [
{
"status": "affected",
"version": "1.66"
}
]
},
{
"cpes": [
"cpe:2.3:o:supermicro:x11sse-f_firmware:1.66:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "x11sse-f_firmware",
"vendor": "supermicro",
"versions": [
{
"status": "affected",
"version": "1.66"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2023-40286",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-03T19:14:42.532402Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-08-03T19:24:37.036Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered on Supermicro X11SSM-F, X11SAE-F, and X11SSE-F 1.66 devices. An attacker could exploit an XSS issue."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-03-27T03:22:31.116Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://www.supermicro.com/en/support/security_center#%21advisories"
},
{
"url": "https://www.supermicro.com/en/support/security_BMC_IPMI_Oct_2023"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2023-40286",
"datePublished": "2024-03-27T00:00:00.000Z",
"dateReserved": "2023-08-14T00:00:00.000Z",
"dateUpdated": "2024-08-03T19:24:37.036Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-40285 (GCVE-0-2023-40285)
Vulnerability from cvelistv5 – Published: 2024-03-27 00:00 – Updated: 2024-12-06 21:16
VLAI
Summary
An issue was discovered on Supermicro X11SSM-F, X11SAE-F, and X11SSE-F 1.66 devices. An attacker could exploit an XSS issue.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- n/a
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T18:31:53.255Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.supermicro.com/en/support/security_center#%21advisories"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.supermicro.com/en/support/security_BMC_IPMI_Oct_2023"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2023-40285",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-06T18:49:32.947751Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-12-06T21:16:17.261Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered on Supermicro X11SSM-F, X11SAE-F, and X11SSE-F 1.66 devices. An attacker could exploit an XSS issue."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-03-27T03:27:56.913Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://www.supermicro.com/en/support/security_center#%21advisories"
},
{
"url": "https://www.supermicro.com/en/support/security_BMC_IPMI_Oct_2023"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2023-40285",
"datePublished": "2024-03-27T00:00:00.000Z",
"dateReserved": "2023-08-14T00:00:00.000Z",
"dateUpdated": "2024-12-06T21:16:17.261Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-40287 (GCVE-0-2023-40287)
Vulnerability from cvelistv5 – Published: 2024-03-27 00:00 – Updated: 2024-08-05 14:45
VLAI
Summary
An issue was discovered on Supermicro X11SSM-F, X11SAE-F, and X11SSE-F 1.66 devices. An attacker could exploit an XSS issue.
Severity
8.3 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- n/a
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| supermicro | x11ssm-f_firmware |
Affected:
1.66
cpe:2.3:o:supermicro:x11ssm-f_firmware:1.66:*:*:*:*:*:*:* |
|
| supermicro | x11sae-f_firmware |
Affected:
1.66
cpe:2.3:o:supermicro:x11sae-f_firmware:1.66:*:*:*:*:*:*:* |
|
| supermicro | x11sse-f_firmware |
Affected:
1.66
cpe:2.3:o:supermicro:x11sse-f_firmware:1.66:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T18:31:53.258Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.supermicro.com/en/support/security_center#%21advisories"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.supermicro.com/en/support/security_BMC_IPMI_Oct_2023"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:o:supermicro:x11ssm-f_firmware:1.66:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "x11ssm-f_firmware",
"vendor": "supermicro",
"versions": [
{
"status": "affected",
"version": "1.66"
}
]
},
{
"cpes": [
"cpe:2.3:o:supermicro:x11sae-f_firmware:1.66:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "x11sae-f_firmware",
"vendor": "supermicro",
"versions": [
{
"status": "affected",
"version": "1.66"
}
]
},
{
"cpes": [
"cpe:2.3:o:supermicro:x11sse-f_firmware:1.66:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "x11sse-f_firmware",
"vendor": "supermicro",
"versions": [
{
"status": "affected",
"version": "1.66"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2023-40287",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-05T14:42:43.396894Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-08-05T14:45:07.159Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered on Supermicro X11SSM-F, X11SAE-F, and X11SSE-F 1.66 devices. An attacker could exploit an XSS issue."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-03-27T03:23:15.329Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://www.supermicro.com/en/support/security_center#%21advisories"
},
{
"url": "https://www.supermicro.com/en/support/security_BMC_IPMI_Oct_2023"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2023-40287",
"datePublished": "2024-03-27T00:00:00.000Z",
"dateReserved": "2023-08-14T00:00:00.000Z",
"dateUpdated": "2024-08-05T14:45:07.159Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-40284 (GCVE-0-2023-40284)
Vulnerability from cvelistv5 – Published: 2024-03-27 00:00 – Updated: 2024-08-05 14:42
VLAI
Summary
An issue was discovered on Supermicro X11SSM-F, X11SAE-F, and X11SSE-F 1.66 devices. An attacker could exploit an XSS issue.
Severity
8.3 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- n/a
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| supermicro | x11ssm-f_firmware |
Affected:
1.66
cpe:2.3:o:supermicro:x11ssm-f_firmware:1.66:*:*:*:*:*:*:* |
|
| supermicro | x11sae-f_firmware |
Affected:
1.66
cpe:2.3:o:supermicro:x11sae-f_firmware:1.66:*:*:*:*:*:*:* |
|
| supermicro | x11sse-f_firmware |
Affected:
1.66
cpe:2.3:o:supermicro:x11sse-f_firmware:1.66:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T18:31:53.130Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.supermicro.com/en/support/security_center#%21advisories"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.supermicro.com/en/support/security_BMC_IPMI_Oct_2023"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:o:supermicro:x11ssm-f_firmware:1.66:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "x11ssm-f_firmware",
"vendor": "supermicro",
"versions": [
{
"status": "affected",
"version": "1.66"
}
]
},
{
"cpes": [
"cpe:2.3:o:supermicro:x11sae-f_firmware:1.66:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "x11sae-f_firmware",
"vendor": "supermicro",
"versions": [
{
"status": "affected",
"version": "1.66"
}
]
},
{
"cpes": [
"cpe:2.3:o:supermicro:x11sse-f_firmware:1.66:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "x11sse-f_firmware",
"vendor": "supermicro",
"versions": [
{
"status": "affected",
"version": "1.66"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2023-40284",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-05T14:35:02.050429Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-08-05T14:42:05.915Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered on Supermicro X11SSM-F, X11SAE-F, and X11SSE-F 1.66 devices. An attacker could exploit an XSS issue."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-03-27T03:20:31.196Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://www.supermicro.com/en/support/security_center#%21advisories"
},
{
"url": "https://www.supermicro.com/en/support/security_BMC_IPMI_Oct_2023"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2023-40284",
"datePublished": "2024-03-27T00:00:00.000Z",
"dateReserved": "2023-08-14T00:00:00.000Z",
"dateUpdated": "2024-08-05T14:42:05.915Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-40289 (GCVE-0-2023-40289)
Vulnerability from cvelistv5 – Published: 2024-03-27 00:00 – Updated: 2024-08-06 14:58
VLAI
Summary
A command injection issue was discovered on Supermicro X11SSM-F, X11SAE-F, and X11SSE-F 1.66 devices. An attacker can exploit this to elevate privileges from a user with BMC administrative privileges.
Severity
7.2 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- n/a
- CWE-269 - Improper Privilege Management
Assigner
References
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| supermicro | x11ssm-f |
Affected:
1.66
cpe:2.3:h:supermicro:x11ssm-f:-:*:*:*:*:*:*:* |
|
| supermicro | x11sae-f |
Affected:
1.66
cpe:2.3:h:supermicro:x11sae-f:-:*:*:*:*:*:*:* |
|
| supermicro | x11sse-f |
Affected:
1.66
cpe:2.3:h:supermicro:x11sse-f:-:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T18:31:52.795Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.supermicro.com/en/support/security_center#%21advisories"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.supermicro.com/en/support/security_BMC_IPMI_Oct_2023"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:h:supermicro:x11ssm-f:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "x11ssm-f",
"vendor": "supermicro",
"versions": [
{
"status": "affected",
"version": "1.66"
}
]
},
{
"cpes": [
"cpe:2.3:h:supermicro:x11sae-f:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "x11sae-f",
"vendor": "supermicro",
"versions": [
{
"status": "affected",
"version": "1.66"
}
]
},
{
"cpes": [
"cpe:2.3:h:supermicro:x11sse-f:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "x11sse-f",
"vendor": "supermicro",
"versions": [
{
"status": "affected",
"version": "1.66"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2023-40289",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-06T14:51:43.218678Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "CWE-269 Improper Privilege Management",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-08-06T14:58:54.338Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A command injection issue was discovered on Supermicro X11SSM-F, X11SAE-F, and X11SSE-F 1.66 devices. An attacker can exploit this to elevate privileges from a user with BMC administrative privileges."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-03-27T03:25:53.042Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://www.supermicro.com/en/support/security_center#%21advisories"
},
{
"url": "https://www.supermicro.com/en/support/security_BMC_IPMI_Oct_2023"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2023-40289",
"datePublished": "2024-03-27T00:00:00.000Z",
"dateReserved": "2023-08-14T00:00:00.000Z",
"dateUpdated": "2024-08-06T14:58:54.338Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-33413 (GCVE-0-2023-33413)
Vulnerability from cvelistv5 – Published: 2023-12-07 00:00 – Updated: 2024-08-02 15:47
VLAI
Summary
The configuration functionality in the Intelligent Platform Management Interface (IPMI) baseboard management controller (BMC) implementation on Supermicro X11 and M11 based devices, with firmware versions through 3.17.02, allows remote authenticated users to execute arbitrary commands.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
2 references
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T15:47:05.256Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "http://supermicro.com"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.supermicro.com/en/support/security_BMC_Dec_2023"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The configuration functionality in the Intelligent Platform Management Interface (IPMI) baseboard management controller (BMC) implementation on Supermicro X11 and M11 based devices, with firmware versions through 3.17.02, allows remote authenticated users to execute arbitrary commands."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-12-07T17:11:13.528Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "http://supermicro.com"
},
{
"url": "https://www.supermicro.com/en/support/security_BMC_Dec_2023"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2023-33413",
"datePublished": "2023-12-07T00:00:00.000Z",
"dateReserved": "2023-05-22T00:00:00.000Z",
"dateUpdated": "2024-08-02T15:47:05.256Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-33412 (GCVE-0-2023-33412)
Vulnerability from cvelistv5 – Published: 2023-12-07 00:00 – Updated: 2024-08-02 15:47
VLAI
Summary
The web interface in the Intelligent Platform Management Interface (IPMI) baseboard management controller (BMC) implementation on Supermicro X11 and M11 based devices, with firmware versions before 3.17.02, allows remote authenticated users to execute arbitrary commands via a crafted request targeting vulnerable cgi endpoints.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
2 references
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T15:47:05.628Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "http://supermicro.com"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.supermicro.com/en/support/security_BMC_Dec_2023"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The web interface in the Intelligent Platform Management Interface (IPMI) baseboard management controller (BMC) implementation on Supermicro X11 and M11 based devices, with firmware versions before 3.17.02, allows remote authenticated users to execute arbitrary commands via a crafted request targeting vulnerable cgi endpoints."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-12-07T17:11:09.358Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "http://supermicro.com"
},
{
"url": "https://www.supermicro.com/en/support/security_BMC_Dec_2023"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2023-33412",
"datePublished": "2023-12-07T00:00:00.000Z",
"dateReserved": "2023-05-22T00:00:00.000Z",
"dateUpdated": "2024-08-02T15:47:05.628Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-33411 (GCVE-0-2023-33411)
Vulnerability from cvelistv5 – Published: 2023-12-07 00:00 – Updated: 2024-11-26 15:28
VLAI
Summary
A web server in the Intelligent Platform Management Interface (IPMI) baseboard management controller (BMC) implementation on Supermicro X11 and M11 based devices, with firmware versions up to 3.17.02, allows remote unauthenticated users to perform directory traversal, potentially disclosing sensitive information.
Severity
No CVSS data available.
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- n/a
Assigner
References
2 references
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T15:47:05.254Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "http://supermicro.com"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.supermicro.com/en/support/security_BMC_Dec_2023"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-33411",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-26T15:28:13.887741Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-26T15:28:31.828Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A web server in the Intelligent Platform Management Interface (IPMI) baseboard management controller (BMC) implementation on Supermicro X11 and M11 based devices, with firmware versions up to 3.17.02, allows remote unauthenticated users to perform directory traversal, potentially disclosing sensitive information."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-12-07T17:11:05.033Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "http://supermicro.com"
},
{
"url": "https://www.supermicro.com/en/support/security_BMC_Dec_2023"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2023-33411",
"datePublished": "2023-12-07T00:00:00.000Z",
"dateReserved": "2023-05-22T00:00:00.000Z",
"dateUpdated": "2024-11-26T15:28:31.828Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}