When creating an OPERATOR user account on the BMC, the redfish plugin saved the auto-generated password to /etc/fwupd/redfish.conf without proper restriction, allowing any user on the system to read the same configuration file.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade fwupd-develUpgrade fwupdUpgrade fwupd-plugin-flashrom | May 15, 2023 | Sep 28, 2022 |
| Centos_linux | — | Upgrade fwupd-plugin-flashrom-debuginfoUpgrade fwupd-debuginfoUpgrade fwupd-plugin-flashromUpgrade fwupd-tests-debuginfoUpgrade fwupdUpgrade fwupd-debugsource | May 15, 2023 | Sep 28, 2022 |
| Debian | — | Upgrade fwupd | Jul 30, 2024 | Sep 28, 2022 |
| Oracle_linux | — | Upgrade fwupd-develUpgrade fwupd-plugin-flashromUpgrade fwupd | May 19, 2023 | Sep 22, 2022 |
| Redhat_linux | — | Upgrade fwupd-tests-debuginfoUpgrade fwupd-debuginfoUpgrade fwupd-plugin-flashromUpgrade fwupd-plugin-flashrom-debuginfoUpgrade fwupdUpgrade fwupd-debugsourceUpgrade fwupd-devel | May 15, 2023 | Sep 28, 2022 |
| Rocky_linux | — | Upgrade fwupdUpgrade fwupd-debuginfoUpgrade fwupd-develUpgrade fwupd-debugsource | Mar 5, 2024 | Sep 28, 2022 |
| Suse | — | Upgrade fwupd-develUpgrade libfwupd2Upgrade fwupdUpgrade typelib-1_0-Fwupd-2_0Upgrade fwupd-bash-completionUpgrade fwupd-lang | Jun 13, 2023 | Sep 28, 2022 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Sep 28, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub