CVE-2021-38960 : IBM OPENBMC OP920, OP930, and OP940 could allow an unauthenticated user to obtain sensitive information. IBM X-Force ID:

IBM OPENBMC OP920, OP930, and OP940 could allow an unauthenticated user to obtain sensitive information. IBM X-Force ID: 212047.

Published 2022-02-04 23:15:12

Updated 2022-02-09 02:54:21

Source IBM Corporation

View at NVD, CVE.org

Vulnerability category: Information leak

Exploit prediction scoring system (EPSS) score for CVE-2021-38960

EPSS FAQ

0.11%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 44 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2021-38960

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
5.0	MEDIUM	AV:N/AC:L/Au:N/C:P/I:N/A:N	10.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None
5.3	MEDIUM	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N	3.9	1.4	IBM Corporation
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: Low Integrity: None Availability: None
7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	3.9	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None

References for CVE-2021-38960

https://exchange.xforce.ibmcloud.com/vulnerabilities/212047

IBM OPENBMC information disclosure CVE-2021-38960 Vulnerability Report
VDB Entry;Vendor Advisory
https://www.ibm.com/support/pages/node/6529322

Security Bulletin: This Power System update is being released to address CVE 2021-38960
Vendor Advisory

Products affected by CVE-2021-38960

IBM » Power System Ac922 (8335-gth) Firmware » Version: Op920
cpe:2.3:o:ibm:power_system_ac922_\(8335-gth\)_firmware:op920:*:*:*:*:*:*:*
Matching versions
When used together with: IBM » Power System Ac922 (8335-gth) » Version: N/A
IBM » Power System Ac922 (8335-gth) Firmware » Version: Op930
cpe:2.3:o:ibm:power_system_ac922_\(8335-gth\)_firmware:op930:*:*:*:*:*:*:*
Matching versions
When used together with: IBM » Power System Ac922 (8335-gth) » Version: N/A
IBM » Power System Ac922 (8335-gth) Firmware » Version: Op940
cpe:2.3:o:ibm:power_system_ac922_\(8335-gth\)_firmware:op940:*:*:*:*:*:*:*
Matching versions
When used together with: IBM » Power System Ac922 (8335-gth) » Version: N/A
IBM » Power System Ac922 (8335-gtx) Firmware » Version: Op920
cpe:2.3:o:ibm:power_system_ac922_\(8335-gtx\)_firmware:op920:*:*:*:*:*:*:*
Matching versions
When used together with: IBM » Power System Ac922 (8335-gtx) » Version: N/A
IBM » Power System Ac922 (8335-gtx) Firmware » Version: Op930
cpe:2.3:o:ibm:power_system_ac922_\(8335-gtx\)_firmware:op930:*:*:*:*:*:*:*
Matching versions
When used together with: IBM » Power System Ac922 (8335-gtx) » Version: N/A
IBM » Power System Ac922 (8335-gtx) Firmware » Version: Op940
cpe:2.3:o:ibm:power_system_ac922_\(8335-gtx\)_firmware:op940:*:*:*:*:*:*:*
Matching versions
When used together with: IBM » Power System Ac922 (8335-gtx) » Version: N/A
IBM » Power Hardware Management Console (7063-cr2) Firmware » Version: Op940
cpe:2.3:o:ibm:power_hardware_management_console_\(7063-cr2\)_firmware:op940:*:*:*:*:*:*:*
Matching versions
When used together with: IBM » Power Hardware Management Console (7063-cr2) » Version: N/A

Vulnerability Details : CVE-2021-38960

Exploit prediction scoring system (EPSS) score for CVE-2021-38960

CVSS scores for CVE-2021-38960

CWE ids for CVE-2021-38960

References for CVE-2021-38960

Products affected by CVE-2021-38960