6.1
CVE-2016-8232
- EPSS 0.24%
- Published 01.03.2017 21:59:00
- Last modified 20.04.2025 01:37:25
- Source psirt@lenovo.com
- Teams watchlist Login
- Open Login
Document Object Model-(DOM) based cross-site scripting vulnerability in the Advanced Management Module (AMM) versions earlier than 66Z of Lenovo IBM BladeCenter HS22, HS22V, HS23, HS23E, HX5 allows an unauthenticated attacker with access to the AMM's IP address to send a crafted URL that could inject a malicious script to access a user's AMM data such as cookies or other session information.
Data is provided by the National Vulnerability Database (NVD)
Ibm ≫ Advanced Management Module Firmware Version-
Ibm ≫ Advanced Management Module Version-
Ibm ≫ Bladecenter Versionhs22
Ibm ≫ Bladecenter Versionhs22v
Ibm ≫ Bladecenter Versionhs23
Ibm ≫ Bladecenter Versionhs23e
Ibm ≫ Bladecenter Versionhx5
Ibm ≫ Bladecenter Versionhs22
Ibm ≫ Bladecenter Versionhs22v
Ibm ≫ Bladecenter Versionhs23
Ibm ≫ Bladecenter Versionhs23e
Ibm ≫ Bladecenter Versionhx5
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Type | Source | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.24% | 0.447 |
| Source | Base Score | Exploit Score | Impact Score | Vector string |
|---|---|---|---|---|
| nvd@nist.gov | 6.1 | 2.8 | 2.7 |
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
|
| nvd@nist.gov | 4.3 | 8.6 | 2.9 |
AV:N/AC:M/Au:N/C:N/I:P/A:N
|
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.