CVE-2023-25508: Path Traversal
NVIDIA DGX-1 BMC contains a vulnerability in the IPMI handler, where an attacker with the appropriate level of authorization can upload and download arbitrary files under certain circumstances, which may lead to denial of service, escalation of privileges, information disclosure, and data tampering.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID of this NVIDIA DGX-1 BMC vulnerability?
The vulnerability ID is CVE-2023-25508.
What is the severity of CVE-2023-25508?
The severity of CVE-2023-25508 is high with a value of 7.8.
What software is affected by CVE-2023-25508?
The affected software is NVIDIA BMC version up to exclusive 3.39.30 and NVIDIA DGX-1 (not vulnerable).
What can an attacker with appropriate authorization do in relation to this vulnerability?
An attacker with appropriate authorization can upload and download arbitrary files, leading to denial of service, escalation of privileges, information disclosure, and data tampering.
How can I fix CVE-2023-25508?
To fix CVE-2023-25508, update NVIDIA BMC to version 3.39.30 or later.