Vulnerability Details : CVE-2023-30630
Dmidecode before 3.5 allows -dump-bin to overwrite a local file. This has security relevance because, for example, execution of Dmidecode via Sudo is plausible.
Exploit prediction scoring system (EPSS) score for CVE-2023-30630
Probability of exploitation activity in the next 30 days: 0.04%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 8 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2023-30630
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Source |
---|---|---|---|---|---|
7.1
|
HIGH | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H |
1.8
|
5.2
|
nvd@nist.gov |
References for CVE-2023-30630
-
https://github.com/adamreiser/dmiwrite
GitHub - adamreiser/dmiwrite: Privilege escalation using dmidecodeExploit;Third Party Advisory
-
https://lists.nongnu.org/archive/html/dmidecode-devel/2023-03/msg00003.html
Dmidecode 3.5 has been releasedMailing List;Patch;Release Notes;Vendor Advisory
-
https://git.savannah.nongnu.org/cgit/dmidecode.git/commit/?id=d8cfbc808f387e87091c25e7d5b8c2bb348bb206
dmidecode.git -Not Applicable
-
https://git.savannah.nongnu.org/cgit/dmidecode.git/commit/?id=6ca381c1247c81f74e1ca4e7706f70bdda72e6f2
dmidecode.git -Not Applicable
Products affected by CVE-2023-30630
- cpe:2.3:a:nongnu:dmidecode:*:*:*:*:*:*:*:*