CVE-2024-22216

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-22216
In default installations of Microchip maxView Storage Manager (for Adaptec Smart Storage Controllers) where Redfish server is configured for remote system management, unauthorized access can occur, with data modification and information disclosure. This affects 3.00.23484 through 4.14.00.26064 (except for the patched versions 3.07.23980 and 4.07.00.25339).

10.0 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References
Link Resource
https://www.microchip.com/en-us/solutions/embedded-security/how-to-report-potential-product-security-vulnerabilities/maxview-storage-manager-redfish-server-vulnerability Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:microchip:maxview_storage_manager:*:*:*:*:*:-:*:*
History

15 Feb 2024, 20:09

Type Values Removed Values Added
CVSS v2 : unknown
v3 : 9.1 		v2 : unknown
v3 : 10.0

11 Jan 2024, 16:44

Type Values Removed Values Added
First Time Microchip maxview Storage Manager
Microchip
References () https://www.microchip.com/en-us/solutions/embedded-security/how-to-report-potential-product-security-vulnerabilities/maxview-storage-manager-redfish-server-vulnerability - () https://www.microchip.com/en-us/solutions/embedded-security/how-to-report-potential-product-security-vulnerabilities/maxview-storage-manager-redfish-server-vulnerability - Vendor Advisory
CWE NVD-CWE-noinfo
CPE cpe:2.3:a:microchip:maxview_storage_manager:*:*:*:*:*:-:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 9.1

08 Jan 2024, 12:02

Type Values Removed Values Added
Summary
  • (es) En las instalaciones predeterminadas de Microchip maxView Storage Manager (para Adaptec Smart Storage Controllers) donde el servidor Redfish está configurado para la administración remota del sistema, puede ocurrir acceso no autorizado, con modificación de datos y divulgación de información. Esto afecta desde 3.00.23484 hasta 4.14.00.26064 (excepto las versiones parcheadas 3.07.23980 y 4.07.00.25339).

08 Jan 2024, 07:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-01-08 07:15

Updated : 2024-02-15 20:09

NVD link : CVE-2024-22216

Mitre link : CVE-2024-22216

CVE.ORG link : CVE-2024-22216

JSON object : View

Products Affected

microchip

  • maxview_storage_manager
CWE
NVD-CWE-noinfo