CVE-2018-16096

Published: Nov 27, 2018Modified: Nov 21, 2024

6.1

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.7

Source: NVD

Description

In System Management Module (SMM) versions prior to 1.06, the SMM web interface for changing Enclosure VPD fails to sufficiently sanitize all input for HTML tags, possibly opening a path for cross-site scripting.

Affected (1)

Products: Lenovo: System Management Module Firmware

Lenovo

1 product

System Management Module Firmware

Configuration A

1 vulnerable · 7 platform

Vulnerable Software	Affected Versions
Lenovo System Management Module Firmware	Before 1.06

Running on/with	Platform Versions
Lenovo Thinkagile Hx Enclosure 7x81	All versions
Lenovo Thinkagile Hx Enclosure 7y87	All versions
Lenovo Thinkagile Hx Enclosure 7z02	All versions
Lenovo Thinkagile Vx Enclosure 7y11	All versions
Lenovo Thinkagile Vx Enclosure 7y91	All versions
Lenovo Thinksystem D2 Enclosure 7x20	All versions
Lenovo Thinksystem Modular Enclosure 7x22	All versions

Related CWEs

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (2)

https://support.lenovo.com/us/en/solutions/LEN-24374

Source: psirt@lenovo.com

Vendor Advisory

https://support.lenovo.com/us/en/solutions/LEN-24374

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.