When creating an OPERATOR user account on the BMC, the redfish plugin saved the auto-generated password to /etc/fwupd/redfish.conf without proper restriction, allowing any user on the system to read the same configuration file.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade fwupdUpgrade fwupd-develUpgrade fwupd-plugin-flashrom | May 15, 2023 | Sep 28, 2022 |
| Centos_linux | — | Upgrade fwupd-plugin-flashrom-debuginfoUpgrade fwupd-debuginfoUpgrade fwupd-plugin-flashromUpgrade fwupd-debugsourceUpgrade fwupd-tests-debuginfoUpgrade fwupd | May 15, 2023 | Sep 28, 2022 |
| Debian | — | Upgrade fwupd | Jul 30, 2024 | Sep 28, 2022 |
| Oracle_linux | — | Upgrade fwupdUpgrade fwupd-plugin-flashromUpgrade fwupd-devel | May 19, 2023 | Sep 22, 2022 |
| Redhat_linux | — | Upgrade fwupd-debuginfoUpgrade fwupd-plugin-flashrom-debuginfoUpgrade fwupd-plugin-flashromUpgrade fwupd-tests-debuginfoUpgrade fwupdUpgrade fwupd-develUpgrade fwupd-debugsource | May 15, 2023 | Sep 28, 2022 |
| Rocky_linux | — | Upgrade fwupd-debugsourceUpgrade fwupd-develUpgrade fwupdUpgrade fwupd-debuginfo | Mar 5, 2024 | Sep 28, 2022 |
| Suse | — | Upgrade fwupd-langUpgrade typelib-1_0-Fwupd-2_0Upgrade fwupd-bash-completionUpgrade fwupd-develUpgrade fwupdUpgrade libfwupd2 | Jun 13, 2023 | Sep 28, 2022 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Sep 28, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub