Database/Control plane, storage & DevOps

Intel Data Center Manager SDK (reference UI): The DCM SDK's reference UI allows an unauthenticated remote attacker

CVE-2018-3679Control plane, storage & DevOpscurated

Impact

The DCM SDK's reference UI allows an unauthenticated remote attacker to execute code with administrator privileges. Reference UIs get shipped into production more often than vendors expect - if you built anything on the DCM SDK, check whether the sample UI went with it.

Who can reach it

Unauthenticated remote attacker able to reach the reference UI.

What to do

Upgrade the DCM SDK past 5.0 and remove the reference UI from any production deployment. Application-level change; no host reboot or firmware.

References

https://nvd.nist.gov/vuln/detail/CVE-2018-3679 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00143.html

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.