by Kastro
Paper/Archive/CVE-2023-34342

CVE-2023-34342

AMI MegaRAC_SPx — AMI BMC contains a vulnerability in the IPMI handler, where an attacker can upload and download arbitrary files under certain circumstanc…

EPSS 0.5%CVSS 9.1
critical.is priorityof 100
36
CVSS 9.1 (NVD)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 44.9.449 × 209.0No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

AMI BMC contains a vulnerability in the IPMI handler, where an attacker can upload and download arbitrary files under certain circumstances, which may lead to denial of service, escalation of privileges, information disclosure, or data tampering.

Affected

ProductAffectedFixed inSource
MegaRAC_SPx12.0 – < 12.712.7CNA
MegaRAC_SPx13.0 – < 13.513.5CNA

Scores by source

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
AMI (CNA)6.0CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

ref9443417.fs1.hubspotusercontent-na1.net/hubfs/9443417/Security%20Advisories/AMI-SA-2023005.pdf