Intel Data Center Manager: Improper neutralisation (injection) in Data Center Manager lets an authenticated user

Impact

Improper neutralisation (injection) in Data Center Manager lets an authenticated user with adjacent access escalate privilege on the management plane.

Who can reach it

Authenticated user with network adjacency to the DCM server.

What to do

Upgrade the Intel Data Center Manager software. This is a management-plane application, so the update is an application upgrade and service restart - no node drain, no firmware, no reboot of managed hosts. The real work is deciding what DCM is allowed to reach: it holds credentials for platform power and telemetry across the fleet, so its network exposure matters more than its version. Upgrade to 4.1 or later.

References