Database/Firmware, BMC & network fabric
Supermicro BMC (IPMI web interface, XSS): Stored/reflected script injection in the BMC web UI
Impact
Stored/reflected script injection in the BMC web UI. On its own it is 'just XSS', but on a BMC the session it hijacks is the one that can mount virtual media, power-cycle the node and flash firmware - so it is the entry step of a full out-of-band takeover chain rather than a cosmetic web bug.
Who can reach it
Requires an operator to load an attacker-influenced BMC page. Any engineer who administers BMCs from a browser is the target, and the attacker only needs to be able to plant content the BMC will render.
What to do
BMC firmware flash per board. Until then, treat BMC web access as a privileged action: dedicated browser profile or jump host, never the same browser session used for general web browsing, and no BMC on a routable network.
References
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.