cnvd - cnvd-2019-25500

cnvd-2019-25500

Vulnerability from cnvd

Title: Intel Rapid Storage Technology Enterprise Intel Accelerated Storage Manager跨站脚本漏洞

Description:

Intel Rapid Storage Technology enterprise（RSTe）是美国英特尔（Intel）公司的一款快速存储技术。Intel Accelerated Storage Manager是其中的一个加速存储管理器。

Intel RSTe中的Intel Accelerated Storage Manager存在跨站脚本漏洞，攻击者可利用该漏洞造成拒绝服务。

Severity: 中

Patch Name: Intel Rapid Storage Technology Enterprise Intel Accelerated Storage Manager跨站脚本漏洞的补丁

Patch Description:

Intel Rapid Storage Technology enterprise（RSTe）是美国英特尔（Intel）公司的一款快速存储技术。Intel Accelerated Storage Manager是其中的一个加速存储管理器。

Intel RSTe中的Intel Accelerated Storage Manager存在跨站脚本漏洞，攻击者可利用该漏洞造成拒绝服务。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description:

厂商已发布了漏洞修复程序，请及时关注更新： https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00226.html

Reference: https://support.lenovo.com/us/zh/product_security/len-27843 http://www.securityfocus.com/bid/108775 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00226.html

Impacted products

Name
Intel Rapid Storage Technology enterprise

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2019-0130",
      "cveUrl": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-0130"
    }
  },
  "description": "Intel Rapid Storage Technology enterprise\uff08RSTe\uff09\u662f\u7f8e\u56fd\u82f1\u7279\u5c14\uff08Intel\uff09\u516c\u53f8\u7684\u4e00\u6b3e\u5feb\u901f\u5b58\u50a8\u6280\u672f\u3002Intel Accelerated Storage Manager\u662f\u5176\u4e2d\u7684\u4e00\u4e2a\u52a0\u901f\u5b58\u50a8\u7ba1\u7406\u5668\u3002\n\nIntel RSTe\u4e2d\u7684Intel Accelerated Storage Manager\u5b58\u5728\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u9020\u6210\u62d2\u7edd\u670d\u52a1\u3002",
  "discovererName": "Marius Gabriel Mihai",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00226.html",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2019-25500",
  "openTime": "2019-08-02",
  "patchDescription": "Intel Rapid Storage Technology enterprise\uff08RSTe\uff09\u662f\u7f8e\u56fd\u82f1\u7279\u5c14\uff08Intel\uff09\u516c\u53f8\u7684\u4e00\u6b3e\u5feb\u901f\u5b58\u50a8\u6280\u672f\u3002Intel Accelerated Storage Manager\u662f\u5176\u4e2d\u7684\u4e00\u4e2a\u52a0\u901f\u5b58\u50a8\u7ba1\u7406\u5668\u3002\r\n\r\nIntel RSTe\u4e2d\u7684Intel Accelerated Storage Manager\u5b58\u5728\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u9020\u6210\u62d2\u7edd\u670d\u52a1\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Intel Rapid Storage Technology Enterprise Intel Accelerated Storage Manager\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": "Intel Rapid Storage Technology enterprise"
  },
  "referenceLink": "https://support.lenovo.com/us/zh/product_security/len-27843\r\nhttp://www.securityfocus.com/bid/108775\r\nhttps://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00226.html",
  "serverity": "\u4e2d",
  "submitTime": "2019-06-11",
  "title": "Intel Rapid Storage Technology Enterprise Intel Accelerated Storage Manager\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e"
}

CVE-2019-0130 (GCVE-0-2019-0130)

Vulnerability from cvelistv5

Published

2019-06-13 15:36

Modified

2024-08-04 17:44

Severity ?

CWE

Escalation of Privilege, Denial of Service

Summary

Reflected XSS in web interface for Intel(R) Accelerated Storage Manager in Intel(R) RSTe before version 5.5.0.2015 may allow an unauthenticated user to potentially enable denial of service via network access.

References

▼	URL	Tags
	https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00226.html	x_refsource_CONFIRM
	http://www.securityfocus.com/bid/108775	vdb-entry, x_refsource_BID
	https://support.lenovo.com/us/en/product_security/LEN-27843	x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	n/a	Intel(R) Accelerated Storage Manager in Intel® Rapid Storage Technology Enterprise Advisory	Version: Version before 5.5.0.2015

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T17:44:14.466Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00226.html"
          },
          {
            "name": "108775",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/108775"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://support.lenovo.com/us/en/product_security/LEN-27843"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Intel(R) Accelerated Storage Manager in Intel\u00ae Rapid Storage Technology Enterprise Advisory",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "Version before 5.5.0.2015"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Reflected XSS in web interface for Intel(R) Accelerated Storage Manager in Intel(R) RSTe before version 5.5.0.2015 may allow an unauthenticated user to potentially enable denial of service via network access."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Escalation of Privilege, Denial of Service",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-06-24T15:33:58",
        "orgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
        "shortName": "intel"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00226.html"
        },
        {
          "name": "108775",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/108775"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://support.lenovo.com/us/en/product_security/LEN-27843"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secure@intel.com",
          "ID": "CVE-2019-0130",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Intel(R) Accelerated Storage Manager in Intel\u00ae Rapid Storage Technology Enterprise Advisory",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "Version before 5.5.0.2015"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Reflected XSS in web interface for Intel(R) Accelerated Storage Manager in Intel(R) RSTe before version 5.5.0.2015 may allow an unauthenticated user to potentially enable denial of service via network access."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Escalation of Privilege, Denial of Service"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00226.html",
              "refsource": "CONFIRM",
              "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00226.html"
            },
            {
              "name": "108775",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/108775"
            },
            {
              "name": "https://support.lenovo.com/us/en/product_security/LEN-27843",
              "refsource": "CONFIRM",
              "url": "https://support.lenovo.com/us/en/product_security/LEN-27843"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
    "assignerShortName": "intel",
    "cveId": "CVE-2019-0130",
    "datePublished": "2019-06-13T15:36:25",
    "dateReserved": "2018-11-13T00:00:00",
    "dateUpdated": "2024-08-04T17:44:14.466Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted