When creating an OPERATOR user account on the BMC, the redfish plugin saved the auto-generated password to /etc/fwupd/redfish.conf without proper restriction, allowing any user on the system to read the same configuration file.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade fwupd-develUpgrade fwupdUpgrade fwupd-plugin-flashrom | May 15, 2023 | Sep 28, 2022 |
| Centos_linux | — | Upgrade fwupd-debugsourceUpgrade fwupd-tests-debuginfoUpgrade fwupdUpgrade fwupd-plugin-flashrom-debuginfoUpgrade fwupd-plugin-flashromUpgrade fwupd-debuginfo | May 15, 2023 | Sep 28, 2022 |
| Debian | — | Upgrade fwupd | Jul 30, 2024 | Sep 28, 2022 |
| Oracle_linux | — | Upgrade fwupd-plugin-flashromUpgrade fwupdUpgrade fwupd-devel | May 19, 2023 | Sep 22, 2022 |
| Redhat_linux | — | Upgrade fwupd-tests-debuginfoUpgrade fwupd-plugin-flashromUpgrade fwupd-debuginfoUpgrade fwupd-plugin-flashrom-debuginfoUpgrade fwupdUpgrade fwupd-develUpgrade fwupd-debugsource | May 15, 2023 | Sep 28, 2022 |
| Rocky_linux | — | Upgrade fwupd-debugsourceUpgrade fwupd-develUpgrade fwupdUpgrade fwupd-debuginfo | Mar 5, 2024 | Sep 28, 2022 |
| Suse | — | Upgrade fwupd-bash-completionUpgrade typelib-1_0-Fwupd-2_0Upgrade fwupd-langUpgrade libfwupd2Upgrade fwupd-develUpgrade fwupd | Jun 13, 2023 | Sep 28, 2022 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Sep 28, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub