CVE-2018-7950

The iBMC (Intelligent Baseboard Management Controller) of some Huawei servers have a JSON injection vulnerability due to insufficient input validation. An authenticated, remote attacker can launch a JSON injection to modify the password of administrator. Successful exploit may allow attackers to obtain the management privilege of the system.
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:huawei:1288h_v5_firmware:100r005c00:*:*:*:*:*:*:*
cpe:2.3:h:huawei:1288h_v5:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
cpe:2.3:o:huawei:2288h_v5_firmware:100r005c00:*:*:*:*:*:*:*
cpe:2.3:h:huawei:2288h_v5:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND
cpe:2.3:o:huawei:2488_v5_firmware:100r005c00:*:*:*:*:*:*:*
cpe:2.3:h:huawei:2488_v5:-:*:*:*:*:*:*:*

Configuration 4 (hide)

AND
cpe:2.3:o:huawei:ch121_v3_firmware:100r001c00:*:*:*:*:*:*:*
cpe:2.3:h:huawei:ch121_v3:-:*:*:*:*:*:*:*

Configuration 5 (hide)

AND
cpe:2.3:o:huawei:ch121l_v3_firmware:100r001c00:*:*:*:*:*:*:*
cpe:2.3:h:huawei:ch121l_v3:-:*:*:*:*:*:*:*

Configuration 6 (hide)

AND
cpe:2.3:o:huawei:ch121l_v5_firmware:100r001c00:*:*:*:*:*:*:*
cpe:2.3:h:huawei:ch121l_v5:-:*:*:*:*:*:*:*

Configuration 7 (hide)

AND
cpe:2.3:o:huawei:ch121_v5_firmware:100r001c00:*:*:*:*:*:*:*
cpe:2.3:h:huawei:ch121_v5:-:*:*:*:*:*:*:*

Configuration 8 (hide)

AND
cpe:2.3:o:huawei:ch140_v3_firmware:100r001c00:*:*:*:*:*:*:*
cpe:2.3:h:huawei:ch140_v3:-:*:*:*:*:*:*:*

Configuration 9 (hide)

AND
cpe:2.3:o:huawei:ch140l_v3_firmware:100r001c00:*:*:*:*:*:*:*
cpe:2.3:h:huawei:ch140l_v3:-:*:*:*:*:*:*:*

Configuration 10 (hide)

AND
cpe:2.3:o:huawei:ch220_v3_firmware:100r001c00:*:*:*:*:*:*:*
cpe:2.3:h:huawei:ch220_v3:-:*:*:*:*:*:*:*

Configuration 11 (hide)

AND
cpe:2.3:o:huawei:ch222_v3_firmware:100r001c00:*:*:*:*:*:*:*
cpe:2.3:h:huawei:ch222_v3:-:*:*:*:*:*:*:*

Configuration 12 (hide)

AND
cpe:2.3:o:huawei:ch242_v3_firmware:100r001c00:*:*:*:*:*:*:*
cpe:2.3:h:huawei:ch242_v3:-:*:*:*:*:*:*:*

Configuration 13 (hide)

AND
cpe:2.3:o:huawei:ch242_v5_firmware:100r001c00:*:*:*:*:*:*:*
cpe:2.3:h:huawei:ch242_v5:-:*:*:*:*:*:*:*

Configuration 14 (hide)

AND
cpe:2.3:o:huawei:rh1288_v3_firmware:100r003c00:*:*:*:*:*:*:*
cpe:2.3:h:huawei:rh1288_v3:-:*:*:*:*:*:*:*

Configuration 15 (hide)

AND
cpe:2.3:o:huawei:rh2288_v3_firmware:100r003c00:*:*:*:*:*:*:*
cpe:2.3:h:huawei:rh2288_v3:-:*:*:*:*:*:*:*

Configuration 16 (hide)

AND
cpe:2.3:o:huawei:xh310_v3_firmware:100r003c00:*:*:*:*:*:*:*
cpe:2.3:h:huawei:xh310_v3:-:*:*:*:*:*:*:*

Configuration 17 (hide)

AND
cpe:2.3:o:huawei:xh321_v3_firmware:100r003c00:*:*:*:*:*:*:*
cpe:2.3:h:huawei:xh321_v3:-:*:*:*:*:*:*:*

Configuration 18 (hide)

AND
cpe:2.3:o:huawei:xh321_v5_firmware:100r005c00:*:*:*:*:*:*:*
cpe:2.3:h:huawei:xh321_v5:-:*:*:*:*:*:*:*

Configuration 19 (hide)

AND
cpe:2.3:o:huawei:rh2288h_v3_firmware:100r003c00:*:*:*:*:*:*:*
cpe:2.3:h:huawei:rh2288h_v3:-:*:*:*:*:*:*:*

Configuration 20 (hide)

AND
cpe:2.3:o:huawei:xh620_v3_firmware:100r003c00:*:*:*:*:*:*:*
cpe:2.3:h:huawei:xh620_v3:-:*:*:*:*:*:*:*

History

21 Nov 2024, 04:13

Type Values Removed Values Added
References () http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20180530-02-server-en - Vendor Advisory () http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20180530-02-server-en - Vendor Advisory

Information

Published : 2018-06-01 14:29

Updated : 2024-11-21 04:13


NVD link : CVE-2018-7950

Mitre link : CVE-2018-7950

CVE.ORG link : CVE-2018-7950


JSON object : View

Products Affected

huawei

  • ch121l_v5_firmware
  • ch140l_v3
  • 2488_v5
  • rh2288_v3
  • ch121l_v3
  • ch140_v3
  • rh2288_v3_firmware
  • xh310_v3_firmware
  • ch242_v5_firmware
  • ch242_v3_firmware
  • xh620_v3
  • 2488_v5_firmware
  • ch242_v3
  • xh310_v3
  • rh1288_v3
  • ch140l_v3_firmware
  • 2288h_v5
  • rh1288_v3_firmware
  • rh2288h_v3
  • ch121_v3_firmware
  • ch121l_v5
  • ch121_v5_firmware
  • xh620_v3_firmware
  • ch242_v5
  • rh2288h_v3_firmware
  • ch222_v3_firmware
  • xh321_v3
  • 2288h_v5_firmware
  • ch121_v5
  • ch121_v3
  • xh321_v5
  • 1288h_v5
  • ch220_v3_firmware
  • xh321_v5_firmware
  • 1288h_v5_firmware
  • ch220_v3
  • ch222_v3
  • ch140_v3_firmware
  • xh321_v3_firmware
  • ch121l_v3_firmware
CWE
CWE-94

Improper Control of Generation of Code ('Code Injection')