Improper Authentication in EDK II Affects Tianocore
CVE-2019-14553

4.9MEDIUM

Key Information:

Vendor

Tianocore

Status
Extensible Firmware Interface Development Kit (edk Ii)
Vendor
CVE Published:
23 November 2020

What is CVE-2019-14553?

An improper authentication flaw in EDK II could potentially allow a privileged user to enable information disclosure through network access. This vulnerability can expose sensitive information if exploited, highlighting the importance of robust authentication mechanisms within the firmware. Security measures must be implemented to safeguard against unauthorized access and ensure that users maintain control over their devices.

Affected Version(s)

Extensible Firmware Interface Development Kit (EDK II) EDK II

References

https://bugzilla.tianocore.org/show_bug.cgi?id=960
x_refsource_MISC

CVSS V3.1

Score:
4.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.