Medium severity · published Apr 25, 2018
CVE-2014-0882
Integrated Management Module II (IMM2) on IBM Flex System, NeXtScale, System x3xxx, and System x iDataPlex systems might allow remote authenticated users to obtain sensitive…
6.5
CVSS
1.2%
EPSS
No
On KEV
Description
Integrated Management Module II (IMM2) on IBM Flex System, NeXtScale, System x3xxx, and System x iDataPlex systems might allow remote authenticated users to obtain sensitive account information via vectors related to generated Service Advisor data (FFDC). IBM X-Force ID: 91149.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 68% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IM
Integrated Management Module Firmware · Ibm
3.50; 3.55; 3.56; 3.65; 3.67 · source: NVD
Affected product
IM
Integrated Management Module Firmware
Ibm
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-0882
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-0882
Third Party Advisory
https://support.lenovo.com/us/en/solutions/ht114525
Vendor Advisory
https://www.ibm.com/blogs/psirt/security-bulletin-account-specific-information-likely-to-be-present-in-service-advisor-data-ffdc-on-the-integrated-management-module-ii-imm2-cve-2014-0882/
Vendor Advisory
https://www.ibm.com/support/home/docdisplay?lndocid=MIGR-5094726
More from Integrated Management Module Firmware
7.4
CVE-2014-0881
The TPM on Integrated Management Module II (IMM2) on IBM Flex System x222 servers with firmware 1.00 through 3.56 allows remote attackers to obtain sensitive key information or…
6.5
CVE-2017-3744
In the IMM2 firmware of Lenovo System x servers, remote commands issued by LXCA or other utilities may be captured in the First Failure Data Capture (FFDC) service log if the…
–
CVE-2014-0860
The firmware before 3.66E in IBM BladeCenter Advanced Management Module (AMM), the firmware before 1.43 in IBM Integrated Management Module (IMM), and the firmware before 4.15 in…