When creating an OPERATOR user account on the BMC, the redfish plugin saved the auto-generated password to /etc/fwupd/redfish.conf without proper restriction, allowing any user on the system to read the same configuration file.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade fwupd-plugin-flashromUpgrade fwupdUpgrade fwupd-devel | May 15, 2023 | Sep 28, 2022 |
| Centos_linux | — | Upgrade fwupd-debugsourceUpgrade fwupd-tests-debuginfoUpgrade fwupdUpgrade fwupd-plugin-flashrom-debuginfoUpgrade fwupd-plugin-flashromUpgrade fwupd-debuginfo | May 15, 2023 | Sep 28, 2022 |
| Debian | — | Upgrade fwupd | Jul 30, 2024 | Sep 28, 2022 |
| Oracle_linux | — | Upgrade fwupdUpgrade fwupd-develUpgrade fwupd-plugin-flashrom | May 19, 2023 | Sep 22, 2022 |
| Redhat_linux | — | Upgrade fwupdUpgrade fwupd-debugsourceUpgrade fwupd-develUpgrade fwupd-plugin-flashromUpgrade fwupd-tests-debuginfoUpgrade fwupd-plugin-flashrom-debuginfoUpgrade fwupd-debuginfo | May 15, 2023 | Sep 28, 2022 |
| Rocky_linux | — | Upgrade fwupd-debugsourceUpgrade fwupd-develUpgrade fwupd-debuginfoUpgrade fwupd | Mar 5, 2024 | Sep 28, 2022 |
| Suse | — | Upgrade fwupd-langUpgrade fwupd-bash-completionUpgrade typelib-1_0-Fwupd-2_0Upgrade fwupd-develUpgrade fwupdUpgrade libfwupd2 | Jun 13, 2023 | Sep 28, 2022 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Sep 28, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub