Lenovo Integrated Management Module 2 (IMM2) 5.50

CPE Details

Lenovo Integrated Management Module 2 (IMM2) 5.50
lenovo
integrated_management_module_2
5.50
2020-09-22
13h31 +00:00
2020-09-22
13h31 +00:00
CPE NVD
Alerte pour un CPE
Stay informed of any changes for a specific CPE.
Notifications manage

CPE Name: cpe:2.3:o:lenovo:integrated_management_module_2:5.50:*:*:*:*:*:*:*

Informations

Vendor

lenovo

Product

integrated_management_module_2

Version

5.50

Related CVE

Open and find in CVE List

CVE ID Published Description Score Severity
CVE-2020-8340 2020-09-15 14h20 +00:00 A cross-site scripting (XSS) vulnerability was discovered in the legacy IBM and Lenovo System x IMM2 (Integrated Management Module 2), prior to version 5.60, embedded Baseboard Management Controller (BMC) web interface during an internal security review. This vulnerability could allow JavaScript code to be executed in the user's web browser if the user is convinced to visit a crafted URL, possibly through phishing. Successful exploitation requires specific knowledge about the user’s network to be included in the crafted URL. Impact is limited to the normal access restrictions and permissions of the user clicking the crafted URL, and subject to the user being able to connect to and already being authenticated to IMM2 or other systems. The JavaScript code is not executed on IMM2 itself.
6.3
Medium
The information presented on CVE Find originates from several carefully selected reference sources. CVE data is provided by MITRE Corporation and the National Vulnerability Database (NVD). The Known Exploited Vulnerabilities (KEV) catalog is sourced from the Cybersecurity and Infrastructure Security Agency (CISA), while EPSS scores come from FIRST.org. Additionally, data regarding software weaknesses (CWE) and common attack patterns (CAPEC) is maintained by MITRE Corporation, and information on hardware and software configurations (CPE) is provided by the NVD.