CVE-2019-6161
High
Description
An internal product security audit discovered a session handling vulnerability in the web interface of ThinkAgile CP-SB (Storage Block) BMC in firmware versions prior to 1908.M. This vulnerability allows session IDs to be reused, which could provide unauthorized access to the BMC under certain circumstances. This vulnerability does not affect ThinkSystem XCC, System x IMM2, or other BMCs.
SeverityHigh
CVSS7.5
Exploit probability—
ProductLenovo Cp Storage Block Firmware
PublishedSep 26, 2019
First seenSep 26, 2019
How to fix
Update
- lenovo cp_storage_block_firmware1908.m or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| lenovo cp_storage_block_firmware | v < 1908.m | 1908.m |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.