Weakness
IBM OPENBMC FW1110.00 through FW1110.20, and FW1060.00 through FW1060.71 allows a user to supply a password with a resource dump request stores that password into the BMC audit log where an admin user can see it.
Affected products
- ibm power_system_s1122_\(9824-22a\)_firmware
- ibm power_system_s1122_\(9824-22a\)
- ibm power_system_s1124_\(9824-42a\)_firmware
- ibm power_system_s1124_\(9824-42a\)
- ibm power_system_s1122s_\(9824-22b\)_firmware
- ibm power_system_s1122s_\(9824-22b\)
- ibm power_system_s1114_\(9824-41b\)_firmware
- ibm power_system_s1114_\(9824-41b\)
References
Find the bug before an attacker does.
Sign in with GitHub and run your first audit in under a minute. The free plan needs no credit card.