{"containers": {"cna": {"affected": [{"product": "System x IMM2", "vendor": "Lenovo Group Ltd.", "versions": [{"status": "affected", "version": "firmware versions earlier than 4.90"}]}, {"product": "System x IMM2", "vendor": "IBM Corporation", "versions": [{"status": "affected", "version": "firmware versions earlier than 6.80"}]}], "datePublic": "2018-07-26T00:00:00", "descriptions": [{"lang": "en", "value": "The IMM2 First Failure Data Capture function collects management module logs and diagnostic information when a hardware error is detected. This information is made available for download through an SFTP server hosted on the IMM2 management network interface. In versions earlier than 4.90 for Lenovo System x and earlier than 6.80 for IBM System x, the credentials to access the SFTP server are hard-coded and described in the IMM2 documentation, allowing an attacker with management network access to obtain the collected FFDC data. After applying the update, the IMM2 will create random SFTP credentials for use with OneCLI."}], "problemTypes": [{"descriptions": [{"description": "Information disclosure", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-07-26T18:57:01", "orgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b", "shortName": "lenovo"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://support.lenovo.com/us/en/solutions/LEN-20227"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "psirt@lenovo.com", "DATE_PUBLIC": "2018-07-26T00:00:00", "ID": "CVE-2018-9068", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "System x IMM2", "version": {"version_data": [{"version_value": "firmware versions earlier than 4.90"}]}}]}, "vendor_name": "Lenovo Group Ltd."}, {"product": {"product_data": [{"product_name": "System x IMM2", "version": {"version_data": [{"version_value": "firmware versions earlier than 6.80"}]}}]}, "vendor_name": "IBM Corporation"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The IMM2 First Failure Data Capture function collects management module logs and diagnostic information when a hardware error is detected. This information is made available for download through an SFTP server hosted on the IMM2 management network interface. In versions earlier than 4.90 for Lenovo System x and earlier than 6.80 for IBM System x, the credentials to access the SFTP server are hard-coded and described in the IMM2 documentation, allowing an attacker with management network access to obtain the collected FFDC data. After applying the update, the IMM2 will create random SFTP credentials for use with OneCLI."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Information disclosure"}]}]}, "references": {"reference_data": [{"name": "https://support.lenovo.com/us/en/solutions/LEN-20227", "refsource": "CONFIRM", "url": "https://support.lenovo.com/us/en/solutions/LEN-20227"}]}}}}, "cveMetadata": {"assignerOrgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b", "assignerShortName": "lenovo", "cveId": "CVE-2018-9068", "datePublished": "2018-07-26T00:00:00", "dateReserved": "2018-03-27T00:00:00", "dateUpdated": "2018-07-26T18:57:01", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:lenovo:flex_system_x240_m4_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "D3AA4469-91DE-4F7B-A2CF-568C05F5E4AE", "versionEndExcluding": "4.90", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:lenovo:flex_system_x240_m4:-:*:*:*:*:*:*:*", "matchCriteriaId": "783B2E41-3FC3-4E39-802F-546EC7AA12E6", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:lenovo:flex_system_x240_m5_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "127A4CC7-08CE-46DF-8C98-7BE845DF2493", "versionEndExcluding": "4.90", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:lenovo:flex_system_x240_m5:-:*:*:*:*:*:*:*", "matchCriteriaId": "2D2CE7A5-1CEE-40C4-BE0E-573C28663A11", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:lenovo:flex_system_x280_x6_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "01F45A40-2C91-4362-866F-C751E4E8507E", "versionEndExcluding": "4.90", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:lenovo:flex_system_x280_x6:-:*:*:*:*:*:*:*", "matchCriteriaId": "1563A13F-2E56-4E83-9C16-68B2C81843DB", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:lenovo:flex_system_x440_m4_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "9FE68A72-826C-4DB6-8ADF-04303B6D9F68", "versionEndExcluding": "4.90", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:lenovo:flex_system_x440_m4:-:*:*:*:*:*:*:*", "matchCriteriaId": "CC55C49B-2A5C-452C-8345-1C19A48FBB6E", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:lenovo:flex_system_x480_x6_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "E6F9B301-C6C4-4AE2-AEF7-035AD4A3D3A8", "versionEndExcluding": "4.90", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:lenovo:flex_system_x480_x6:-:*:*:*:*:*:*:*", "matchCriteriaId": "F86B6B27-0E42-47C1-B2D9-A6C5B1364D9A", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:lenovo:flex_system_x880_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "003631A2-F0BD-4F2D-853B-92AA80535811", "versionEndExcluding": "4.90", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:lenovo:flex_system_x880:-:*:*:*:*:*:*:*", "matchCriteriaId": "68ED17ED-BE60-4EE3-9599-C88C3C7A626C", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:lenovo:nextscale_nx360_m5_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "17771FAE-38EA-41A5-9C93-286642E08692", "versionEndExcluding": "4.90", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:lenovo:nextscale_nx360_m5:-:*:*:*:*:*:*:*", "matchCriteriaId": "723D2A74-F6F3-4C73-AFD9-CDAE930D0FB9", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:lenovo:system_x3250_m6_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "2B3D890D-79FE-43CA-881B-8B9FAB745B47", "versionEndExcluding": "4.90", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:lenovo:system_x3250_m6:-:*:*:*:*:*:*:*", "matchCriteriaId": "D89A2206-7012-4938-9BE2-ACF014E3F3B2", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:lenovo:system_x3500_m5_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "2393A517-E1FA-42AD-A40A-E1C00E135962", "versionEndExcluding": "4.90", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:lenovo:system_x3500_m5:-:*:*:*:*:*:*:*", "matchCriteriaId": "5FC3467C-3F00-4EE3-B40E-3AE7F93094DD", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:lenovo:system_x3550_m5_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "41F41191-D8A4-45A9-90B4-46A974DBEFB7", "versionEndExcluding": "4.90", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:lenovo:system_x3550_m5:-:*:*:*:*:*:*:*", "matchCriteriaId": "57A78B63-6588-4C40-BEBB-88C8DF467A18", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:lenovo:system_x3650_m5_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "F75B122F-C126-4726-9599-96F8ACDAEAAE", "versionEndExcluding": "4.90", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:lenovo:system_x3650_m5:-:*:*:*:*:*:*:*", "matchCriteriaId": "145F0B3C-A945-443B-AB08-329F72358801", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:lenovo:system_x3750_m4_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "FCF06210-2034-422B-884F-FAFFF9F5E7F5", "versionEndExcluding": "4.90", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:lenovo:system_x3750_m4:-:*:*:*:*:*:*:*", "matchCriteriaId": "6A554CB8-7FE1-454D-8E3D-AA3EC80EEB90", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:lenovo:system_x3850_x6_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "ADBFA57E-F2A7-4960-B388-A21F1C277A2B", "versionEndExcluding": "4.90", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:lenovo:system_x3850_x6:-:*:*:*:*:*:*:*", "matchCriteriaId": "F70A2471-D476-4FB7-8D1F-FEE0E4BF460C", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:lenovo:system_x3950_x6_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "644708FB-7C30-4DB2-862A-E7AD8B9AC0A8", "versionEndExcluding": "4.90", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:lenovo:system_x3950_x6:-:*:*:*:*:*:*:*", "matchCriteriaId": "25A3A89F-CB39-4E76-BC64-3C4F4788FB8C", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:ibm:bladecenter_hs22_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "A49BE897-592D-491E-AB25-C641BE74A0C6", "versionEndExcluding": "6.80", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:ibm:bladecenter_hs22:-:*:*:*:*:*:*:*", "matchCriteriaId": "0E9180CC-F795-4B8D-B9BF-37488D352AC0", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:ibm:bladecenter_hs23_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "BF33F7C1-7390-47CF-B1C4-30636F2FFC96", "versionEndExcluding": "6.80", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:ibm:bladecenter_hs23:-:*:*:*:*:*:*:*", "matchCriteriaId": "C010052B-1EBD-4129-9DCE-077575B8286A", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:ibm:bladecenter_hs23e_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "485A886E-EE8B-47F7-AC39-A311544739C4", "versionEndExcluding": "6.80", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:ibm:bladecenter_hs23e:-:*:*:*:*:*:*:*", "matchCriteriaId": "A5F02BE9-BA77-4DC2-AB7A-BF53FE3B7CA0", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:ibm:flex_system_x220_m4_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "96B8AE78-70F8-4961-B173-3BBE73EB80DD", "versionEndExcluding": "6.80", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:ibm:flex_system_x220_m4:-:*:*:*:*:*:*:*", "matchCriteriaId": "B6A0AABD-73B4-4311-9185-643DE173092E", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:ibm:flex_system_x222_m4_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "ADDC859F-23B8-4EE6-B331-107B22E18417", "versionEndExcluding": "6.80", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:ibm:flex_system_x222_m4:-:*:*:*:*:*:*:*", "matchCriteriaId": "04CC2E42-2E9F-4C41-9A36-4A21C32F4CB9", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:ibm:flex_system_x240_m4_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "8001DD7C-3FA3-4FF1-88B2-FB2CDC97D6ED", "versionEndExcluding": "6.80", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:ibm:flex_system_x240_m4:-:*:*:*:*:*:*:*", "matchCriteriaId": "594B1D02-B6ED-4F9F-BAEC-313FFD1C17C4", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:ibm:flex_system_x280_m4_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "78BEDB5B-E5DE-42ED-84CD-B822EDBBD92D", "versionEndExcluding": "6.80", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:ibm:flex_system_x280_m4:-:*:*:*:*:*:*:*", "matchCriteriaId": "828C175A-0B5F-453D-A661-0AD955DB22C6", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:ibm:flex_system_x440_m4_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "6ACDA1F4-DC48-44D2-832F-F8864049F46F", "versionEndExcluding": "6.80", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:ibm:flex_system_x440_m4:-:*:*:*:*:*:*:*", "matchCriteriaId": "E5934364-CF52-411C-B13F-A8688A7BC0FE", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:ibm:flex_system_x480_m4_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "4C44899F-0F88-4881-BC82-69532673D85A", "versionEndExcluding": "6.80", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:ibm:flex_system_x480_m4:-:*:*:*:*:*:*:*", "matchCriteriaId": "3A17A8F8-F833-4F5E-A0ED-CF01B1ABAA9F", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:ibm:flex_system_x880_m4_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "65601BD9-1BAF-4E61-B7D4-ADCB8A61E073", "versionEndExcluding": "6.80", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:ibm:flex_system_x880_m4:-:*:*:*:*:*:*:*", "matchCriteriaId": "FC450128-EDFE-4BD3-A87F-946EED1E0E39", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:ibm:idataplex_dx360_m4_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "CF5491D7-AE3A-4060-AB2E-6CEDE3A466F1", "versionEndExcluding": "6.80", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:ibm:idataplex_dx360_m4:-:*:*:*:*:*:*:*", "matchCriteriaId": "29845B4B-04B8-4685-948F-4DD19C88D7AB", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:ibm:idataplex_dx360_m4_water_cooled_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "A529319C-0EF1-4D12-B032-74B985FF16C0", "versionEndExcluding": "6.80", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:ibm:idataplex_dx360_m4_water_cooled:-:*:*:*:*:*:*:*", "matchCriteriaId": "2C7EABA0-ADB1-4A9B-AB96-FF6BB5720C50", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:ibm:nextscale_nx360_m4_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "E7D2A225-5C7D-4277-9DBB-1E186000E6D1", "versionEndExcluding": "6.80", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:ibm:nextscale_nx360_m4:-:*:*:*:*:*:*:*", "matchCriteriaId": "9642CB05-D7EE-4AFA-A28F-A6E7961A57EA", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:ibm:system_x3100_m4_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "28C76751-393A-46DE-A8EC-8129BA9582F6", "versionEndExcluding": "6.80", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:ibm:system_x3100_m4:-:*:*:*:*:*:*:*", "matchCriteriaId": "B66DB82A-0FF6-452B-8B11-239BF391AD12", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:ibm:system_x3100_m5_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "09D1B7F0-9908-47C3-8DB4-EC9657D0CCB0", "versionEndExcluding": "6.80", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:ibm:system_x3100_m5:-:*:*:*:*:*:*:*", "matchCriteriaId": "8A58320C-8C0B-4819-838A-AE31F9BFC70E", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:ibm:system_x3250_m4_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "4D374BCB-AAD4-4E87-A0ED-6FAEC3A671EB", "versionEndExcluding": "6.80", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:ibm:system_x3250_m4:-:*:*:*:*:*:*:*", "matchCriteriaId": "F3672040-7C51-4C83-A62C-096B2B0E5289", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:ibm:system_x3250_m5_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "A5A6F7B6-F230-450C-B2A1-0C9AABB7C834", "versionEndExcluding": "6.80", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:ibm:system_x3250_m5:-:*:*:*:*:*:*:*", "matchCriteriaId": "57E3BC19-4A70-4225-91E4-1DAE6C1986E7", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:ibm:system_x3300_m4_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "74886C09-D9AC-4F5B-B5D5-CCCD477E43B8", "versionEndExcluding": "6.80", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:ibm:system_x3300_m4:-:*:*:*:*:*:*:*", "matchCriteriaId": "FD693FE0-9B91-4F52-AE89-C82ED55DE43C", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:ibm:system_x3500_m4_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "CFF3E405-B028-4EB7-AE49-797A55B201E0", "versionEndExcluding": "6.80", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:ibm:system_x3500_m4:-:*:*:*:*:*:*:*", "matchCriteriaId": "F943B01A-635B-4F62-96DE-715FFA007AA9", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:ibm:system_x3530_m4_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "671D194C-063A-4558-BC22-6BA0CFF5D0F1", "versionEndExcluding": "6.80", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:ibm:system_x3530_m4:-:*:*:*:*:*:*:*", "matchCriteriaId": "5DAFFBE1-E343-4DCB-A44D-2E29C547CC28", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:ibm:system_x3550_m4_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "687DAA9F-F10F-41AF-969D-7C4C773BD392", "versionEndExcluding": "6.80", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:ibm:system_x3550_m4:-:*:*:*:*:*:*:*", "matchCriteriaId": "98F407F5-EF7C-4F65-8978-3FB80CB07C06", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:ibm:system_x3630_m4_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "773D2239-ED51-4927-BE55-D25A95BD42D1", "versionEndExcluding": "6.80", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:ibm:system_x3630_m4:-:*:*:*:*:*:*:*", "matchCriteriaId": "E3B656E6-B70F-49AB-B17C-F89849CA516E", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:ibm:system_x3650_m4_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "A5D1D239-A124-4C7B-BDDC-E1F1130E07D7", "versionEndExcluding": "6.80", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:ibm:system_x3650_m4:-:*:*:*:*:*:*:*", "matchCriteriaId": "521ED7F3-84FD-4D6C-9EEE-83A52734602A", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:ibm:system_x3650_m4_bd_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "F9D95BBF-BC36-4F7A-83A1-C1C3A151AF6E", "versionEndExcluding": "6.80", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:ibm:system_x3650_m4_bd:-:*:*:*:*:*:*:*", "matchCriteriaId": "967EE555-D0BF-4505-BB9D-0A7A92E94889", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:ibm:system_x3650_m4_hd_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "ADCA4009-4DA3-4DE5-B7E3-DAA17837D304", "versionEndExcluding": "6.80", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:ibm:system_x3650_m4_hd:-:*:*:*:*:*:*:*", "matchCriteriaId": "44DF5766-53F1-4AE8-AB8F-97C0F36215B7", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:ibm:system_x3750_m4_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "A3F08B2B-A9E9-4FAA-9C51-2E3F84B24A59", "versionEndExcluding": "6.80", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:ibm:system_x3750_m4:-:*:*:*:*:*:*:*", "matchCriteriaId": "268FEAB9-EEB1-4B00-A086-1185B0A35959", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:ibm:system_x3850_x6_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "6141A253-B5CD-4A3C-9393-3CC2E0A41006", "versionEndExcluding": "6.80", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:ibm:system_x3850_x6:-:*:*:*:*:*:*:*", "matchCriteriaId": "C8ED74FB-C819-4BD9-9986-2588FCC2D308", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:ibm:system_x3950_x6_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "81C11DAA-A933-444F-AFC0-9AD8ABB2D79F", "versionEndExcluding": "6.80", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:ibm:system_x3950_x6:-:*:*:*:*:*:*:*", "matchCriteriaId": "8DDB4836-D812-4818-AC08-38EABD56F3EF", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "The IMM2 First Failure Data Capture function collects management module logs and diagnostic information when a hardware error is detected. This information is made available for download through an SFTP server hosted on the IMM2 management network interface. In versions earlier than 4.90 for Lenovo System x and earlier than 6.80 for IBM System x, the credentials to access the SFTP server are hard-coded and described in the IMM2 documentation, allowing an attacker with management network access to obtain the collected FFDC data. After applying the update, the IMM2 will create random SFTP credentials for use with OneCLI."}, {"lang": "es", "value": "La funci\u00f3n IMM2 First Failure Data Capture recopila informaci\u00f3n de diagn\u00f3stico y registros de los m\u00f3dulos de gesti\u00f3n cuando se detecta un error de hardware. Esta informaci\u00f3n est\u00e1 disponible para su descarga mediante un servidor SFTP alojado en la interfaz de gesti\u00f3n de red de IMM2. En versiones anteriores a la 4.90 para Lenovo System y anteriores a la 6.80 para IBM System x, las credenciales para acceder al servidor SFTP est\u00e1n embebidas y se describen en la documentaci\u00f3n de IMM2. Esto permite que un atacante con acceso de gesti\u00f3n a la red obtenga los datos FFDC recopilados. Tras aplicar la actualizaci\u00f3n, IMM2 crear\u00e1 credenciales SFTP aleatorias para emplearlas con OneCLI."}], "id": "CVE-2018-9068", "lastModified": "2018-09-28T20:04:58.990", "metrics": {"cvssMetricV2": [{"acInsufInfo": true, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.0"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2018-07-26T19:29:00.487", "references": [{"source": "psirt@lenovo.com", "tags": ["Vendor Advisory"], "url": "https://support.lenovo.com/us/en/solutions/LEN-20227"}], "sourceIdentifier": "psirt@lenovo.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-798"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}