CVE-2010-2656

Currently unrated

Key Information:

Vendor
IBM
Status
Advanced Management Module
Vendor
CVE Published:
8 July 2010

Summary

The IBM BladeCenter with Advanced Management Module (AMM) firmware build ID BPET48L, and possibly other versions before 4.7 and 5.0, stores sensitive information under the web root with insufficient access control, which allows remote attackers to download (1) logs or (2) core files via direct requests, as demonstrated by a request for private/sdc.tgz.

References

http://www.exploit-db.com/exploits/14237/
exploitx_refsource_EXPLOIT-DB
http://www.securityfocus.com/bid/41383
vdb-entryx_refsource_BID
http://dsecrg.com/pages/vul/show.php?id=154
x_refsource_MISC

EPSS Score

44% chance of being exploited in the next 30 days.

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.