CVE-2018-16096 : In System Management Module (SMM) versions prior to 1.06, the SMM web interface for changing Enclosure VPD fails to suff

In System Management Module (SMM) versions prior to 1.06, the SMM web interface for changing Enclosure VPD fails to sufficiently sanitize all input for HTML tags, possibly opening a path for cross-site scripting.

Published 2018-11-27 14:29:01

Updated 2018-12-19 22:15:10

Source Lenovo Group Ltd.

View at NVD, CVE.org

Vulnerability category: Cross site scripting (XSS)

Products affected by CVE-2018-16096

Lenovo » System Management Module Firmware
Versions before (<) 1.06
cpe:2.3:o:lenovo:system_management_module_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinkagile Hx Enclosure 7x81 » Version: N/A
When used together with: Lenovo » Thinkagile Hx Enclosure 7y87 » Version: N/A
When used together with: Lenovo » Thinkagile Hx Enclosure 7z02 » Version: N/A
When used together with: Lenovo » Thinkagile Vx Enclosure 7y11 » Version: N/A
When used together with: Lenovo » Thinkagile Vx Enclosure 7y91 » Version: N/A
When used together with: Lenovo » Thinksystem D2 Enclosure 7x20 » Version: N/A
When used together with: Lenovo » Thinksystem Modular Enclosure 7x22 » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2018-16096

EPSS FAQ

0.08%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 33 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2018-16096

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
4.3	MEDIUM	AV:N/AC:M/Au:N/C:N/I:P/A:N	8.6	2.9	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: None Integrity Impact: Partial Availability Impact: None
6.1	MEDIUM	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	2.8	2.7	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Changed Confidentiality: Low Integrity: Low Availability: None

CWE ids for CVE-2018-16096

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2018-16096

https://support.lenovo.com/us/en/solutions/LEN-24374

System Management Module Vulnerabilities - US
Vendor Advisory

CVEs referencing this url

Jump to

Vulnerability Details : CVE-2018-16096

Products affected by CVE-2018-16096

Exploit prediction scoring system (EPSS) score for CVE-2018-16096

CVSS scores for CVE-2018-16096

CWE ids for CVE-2018-16096

References for CVE-2018-16096