CSRF Vulnerability in Supermicro X10DRH-iT Motherboards
CVE-2020-15046

8.8HIGH

Key Information:

Vendor

Supermicro

Status
X10drh-it Bios
X10drh-it Firmware
Vendor
CVE Published:
24 June 2020

What is CVE-2020-15046?

The web interface of Supermicro X10DRH-iT motherboards with BIOS version 2.0a and IPMI firmware 03.40 exposes users to a Cross-Site Request Forgery (CSRF) vulnerability. This flaw allows unauthorized remote attackers to execute actions on behalf of legitimate users without their consent, potentially enabling them to add new admin users. The risk is mitigated in updated versions: BIOS 3.2 and firmware 03.88.

References

https://www.totalpentest.com/post/supermicro-ipmi-webgui-...
x_refsource_MISC
http://packetstormsecurity.com/files/158373/SuperMicro-IP...
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2020-15046 : CSRF Vulnerability in Supermicro X10DRH-iT Motherboards