CVE-2017-3744 : In the IMM2 firmware of Lenovo System x servers, remote commands issued by LXCA or other utilities may be captured in th

In the IMM2 firmware of Lenovo System x servers, remote commands issued by LXCA or other utilities may be captured in the First Failure Data Capture (FFDC) service log if the service log is generated when that remote command is running. Captured command data may contain clear text login information. Authorized users that can capture and export FFDC service log data may have access to these remote commands.

Published 2017-06-20 00:29:00

Updated 2019-10-03 00:03:26

Source Lenovo Group Ltd.

View at NVD, CVE.org

Exploit prediction scoring system (EPSS) score for CVE-2017-3744

EPSS FAQ

0.06%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 23 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2017-3744

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
4.0	MEDIUM	AV:N/AC:L/Au:S/C:P/I:N/A:N	8.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: Single Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None
6.5	MEDIUM	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N	2.8	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None

CWE ids for CVE-2017-3744

CWE-532 Insertion of Sensitive Information into Log File

Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.

Assigned by: nvd@nist.gov (Primary)

Products affected by CVE-2017-3744

IBM » Integrated Management Module Firmware
Versions up to, including, (<=) 6.19
cpe:2.3:o:ibm:integrated_management_module_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: IBM » Bladecenter Hs22 » Version: N/A
When used together with: IBM » Bladecenter Hs23 » Version: N/A
When used together with: IBM » Bladecenter Hs23e » Version: N/A
When used together with: IBM » Flex System X220 M4 » Version: N/A
When used together with: IBM » Flex System X222 M4 » Version: N/A
When used together with: IBM » Flex System X240 M4 » Version: N/A
When used together with: IBM » Flex System X280 M4 » Version: N/A
When used together with: IBM » Flex System X440 M4 » Version: N/A
When used together with: IBM » Flex System X480 M4 » Version: N/A
When used together with: IBM » Flex System X880 M4 » Version: N/A
When used together with: IBM » Idataplex Dx360 M4 » Version: N/A
When used together with: IBM » Idataplex Dx360 M4 Water Cooled » Version: N/A
When used together with: IBM » Nextscale Nx360 M4 » Version: N/A
When used together with: IBM » System X3100 M4 » Version: N/A
When used together with: IBM » System X3100 M5 » Version: N/A
When used together with: IBM » System X3250 M4 » Version: N/A
When used together with: IBM » System X3250 M5 » Version: N/A
When used together with: IBM » System X3300 M4 » Version: N/A
When used together with: IBM » System X3500 M4 » Version: N/A
When used together with: IBM » System X3530 M4 » Version: N/A
When used together with: IBM » System X3550 M4 » Version: N/A
When used together with: IBM » System X3630 M4 » Version: N/A
When used together with: IBM » System X3650 M4 » Version: N/A
When used together with: IBM » System X3650 M4 Bd » Version: N/A
When used together with: IBM » System X3650 M4 Hd » Version: N/A
When used together with: IBM » System X3750 M4 » Version: N/A
When used together with: IBM » System X3850 X6 » Version: N/A
When used together with: IBM » System X3950 X6 » Version: N/A
Lenovo » Integrated Management Module Firmware
Versions up to, including, (<=) 4.9
cpe:2.3:o:lenovo:integrated_management_module_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Flex System X240 M4 » Version: N/A
When used together with: Lenovo » Flex System X240 M5 » Version: N/A
When used together with: Lenovo » Flex System X280 X6 » Version: N/A
When used together with: Lenovo » Flex System X440 M4 » Version: N/A
When used together with: Lenovo » Flex System X480 X6 » Version: N/A
When used together with: Lenovo » Flex System X880 » Version: N/A
When used together with: Lenovo » Nextscale Nx360 M5 » Version: N/A
When used together with: Lenovo » System X3250 M6 » Version: N/A
When used together with: Lenovo » System X3500 M5 » Version: N/A
When used together with: Lenovo » System X3550 M5 » Version: N/A
When used together with: Lenovo » System X3650 M5 » Version: N/A
When used together with: Lenovo » System X3750 M4 » Version: N/A
When used together with: Lenovo » System X3850 X6 » Version: N/A
When used together with: Lenovo » System X3950 X6 » Version: N/A
When used together with: Lenovo » Thinkagile Cx2200 » Version: N/A
When used together with: Lenovo » Thinkagile Cx4200 » Version: N/A
When used together with: Lenovo » Thinkagile Cx4600 » Version: N/A

Vulnerability Details : CVE-2017-3744

Exploit prediction scoring system (EPSS) score for CVE-2017-3744

CVSS scores for CVE-2017-3744

CWE ids for CVE-2017-3744

References for CVE-2017-3744

Products affected by CVE-2017-3744