Supermicro BMC (IPMI web interface, XSS): Further injection point in the same BMC web stack

Impact

Further injection point in the same BMC web stack; the payoff is a hijacked administrative session with out-of-band control of the server.

Who can reach it

Network reach to the BMC web interface plus operator interaction.

What to do

BMC firmware flash per board, bundled with the batch.

References

Related entries

• Supermicro BMC (IPMI web interface, XSS): Another injection point in the BMC web interface, lower-impact thanCVE-2023-40285 · Supermicro BMC (IPMI web interface, XSS)Medium
• Supermicro BMC (IPMI web interface, XSS): Stored/reflected script injection in the BMC web UICVE-2023-40284 · Supermicro BMC (IPMI web interface, XSS)High
• Supermicro BMC (IPMI web interface, XSS): Script injection in the BMC management UI, scope-changing becauseCVE-2023-40287 · Supermicro BMC (IPMI web interface, XSS)High
• Supermicro BMC (IPMI web interface, XSS via IE11): Injection that fires specifically through Internet Explorer 11CVE-2023-40290 · Supermicro BMC (IPMI web interface, XSS via IE11)High
• shim (HTTP boot): Out-of-bounds write from a crafted HTTP response during network bootCVE-2023-40547 · shim (HTTP boot)High
• AMI AptioV UEFI BIOS (EDK II network stack, DHCPv6 client): Buffer overflow in the firmware's DHCPv6 client, triggeredCVE-2023-45230 · AMI AptioV UEFI BIOS (EDK II network stack, DHCPv6 client)High