CVE-2010-2656
Summary
| CVE | CVE-2010-2656 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2010-07-08 12:54:00 UTC |
| Updated | 2010-07-20 05:48:00 UTC |
| Description | The IBM BladeCenter with Advanced Management Module (AMM) firmware build ID BPET48L, and possibly other versions before 4.7 and 5.0, stores sensitive information under the web root with insufficient access control, which allows remote attackers to download (1) logs or (2) core files via direct requests, as demonstrated by a request for private/sdc.tgz. |
Risk And Classification
Problem Types: CWE-264
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Malformed Request | BID | www.securityfocus.com | Exploit |
| 66123 | OSVDB | osvdb.org | |
| Digital Security Research Group - [DSECRG-09-054] IBM Bladecenter Management - Multiple vulnerabilities | MISC | dsecrg.com | Exploit |
| IBM Bladecenter Management - Multiple web application vulnerabilities | EXPLOIT-DB | www.exploit-db.com | Exploit |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.