CVE-2021-38960: Infoleak
Published Oct 26, 2021
·Updated
IBM OPENBMC could allow an unauthenticated user to obtain sensitive information.
Other sources
IBM OPENBMC OP920, OP930, and OP940 could allow an unauthenticated user to obtain sensitive information. IBM X-Force ID: 212047.
Affected Software
12 affected components
IBM Power System Ac922 \(8335-gtx\) Firmware=op920
IBM Power System Ac922 \(8335-gtx\) Firmware=op930
IBM Power System Ac922 \(8335-gtx\) Firmware=op940
IBM Power System Ac922 \(8335-gtx\)
IBM Power System Ac922 \(8335-gth\) Firmware=op920
IBM Power System Ac922 \(8335-gth\) Firmware=op930
IBM Power System Ac922 \(8335-gth\) Firmware=op940
IBM Power System Ac922 \(8335-gth\)
IBM Power Hardware Management Console \(7063-cr2\) Firmware=op940
IBM Power Hardware Management Console \(7063-cr2\)
IBM OPENBMC<=OP920, OP930, OP940
IBM HMC<=OP940
Event History
Oct 26, 2021
CVE Published
via IBM·12:00 AM
Feb 4, 2022
CVE Published
via MITRE·10:33 PM
Data Sourced
via MITRE·10:33 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2021-38960?
CVE-2021-38960 is classified as a medium severity vulnerability.
2
How does CVE-2021-38960 affect IBM OPENBMC?
CVE-2021-38960 allows an unauthenticated user to access sensitive information within affected IBM OPENBMC versions OP920, OP930, and OP940.
3
What versions of IBM products are affected by CVE-2021-38960?
CVE-2021-38960 affects IBM OPENBMC versions OP920, OP930, and OP940, along with HMC version OP940.
4
How do I fix CVE-2021-38960?
To mitigate CVE-2021-38960, it is recommended to upgrade to the latest version of IBM OPENBMC or apply available patches from IBM.
5
Is CVE-2021-38960 exploitable remotely?
Yes, CVE-2021-38960 can be exploited remotely by unauthenticated users without requiring any credentials.