Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2020-8339

Quick assessment

Affected
IBM BladeCenter AMM firmware
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

IBM BladeCenter是美国IBM公司的一款刀片式服务器。该服务器是指在标准高度的机架式机箱内可插装多个卡式的服务器单元，是一种实现HAHD(High Availability High Density，高可用高密度)的低成本服务器平台，为特殊应用行业和高密度计算环境专门设计。 IBM BladeCenter存在跨站脚本漏洞。该漏洞源于WEB应用缺少对客户端数据的正确验证。攻击者可利用该漏洞执行客户端代码。

CVSS 4.3 · Medium EPSS 0.67% · P50
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2020-8339

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
A cross-site scripting inclusion (XSSI) vulnerability was reported in the legacy IBM BladeCenter Advanced Management Module (AMM) web interface prior to version 3.68n [BPET68N]. This vulnerability could allow an authenticated user's AMM credentials to be disclosed if the user is convinced to visit a malicious web site, possibly through phishing. Successful exploitation requires specific knowledge about the user’s network to be included in the malicious web site. Impact is limited to the normal access restrictions of the user visiting the malicious web site, and subject to the user being logged into AMM, being able to connect to both AMM and the malicious web site while the web browser is open, and using a web browser that does not inherently protect against this class of attack. The JavaScript code is not executed on AMM itself.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
不充分的凭证保护机制
Source: CVE Program / CVE List V5
Vulnerability Title
IBM BladeCenter 跨站脚本漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
IBM BladeCenter是美国IBM公司的一款刀片式服务器。该服务器是指在标准高度的机架式机箱内可插装多个卡式的服务器单元，是一种实现HAHD(High Availability High Density，高可用高密度)的低成本服务器平台，为特殊应用行业和高密度计算环境专门设计。 IBM BladeCenter存在跨站脚本漏洞。该漏洞源于WEB应用缺少对客户端数据的正确验证。攻击者可利用该漏洞执行客户端代码。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
IBM BladeCenter AMM firmware unspecified ~ 3.68n [BPET68N] -

II. Public POCs for CVE-2020-8339

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2020-8339

请登录查看更多情报信息。

Vendor Advisories for CVE-2020-8339 (1)

Same Patch Batch · IBM · 2020-09-15 · 8 CVEs total

CVE-2020-4711 IBM Spectrum Protect Plus 路径遍历漏洞
CVE-2020-4526 IBM Maximo Asset Management 跨站请求伪造漏洞
CVE-2020-4530 IBM Business Process Manager和IBM Business Automation Workflow 跨站脚本漏洞
CVE-2020-4703 IBM Spectrum Protect Plus 代码问题漏洞
CVE-2020-4344 IBM Tivoli Business Service Manager 安全漏洞
CVE-2020-4521 IBM Maximo Asset Management 代码问题漏洞
CVE-2019-4671 IBM Maximo Asset Management SQL注入漏洞

IV. Related Vulnerabilities

Same vendor: IBM
Same weakness: CWE-522

V. Comments for CVE-2020-8339

No comments yet

Leave a comment