1. Home
  2. CVE Database
  3. CVE-2018-16096
MEDIUM · 6.1

CVE-2018-16096

In System Management Module (SMM) versions prior to 1.06, the SMM web interface for changing Enclosure VPD fails to sufficiently sanitize all input for HTML tags, possibly opening a path for cross-sit...

Vulnerability Description

In System Management Module (SMM) versions prior to 1.06, the SMM web interface for changing Enclosure VPD fails to sufficiently sanitize all input for HTML tags, possibly opening a path for cross-site scripting.

CVSS Score

6.1

MEDIUM

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality
LOW
Integrity
LOW
Availability
NONE

Affected Products

VendorProductVersions
LenovoSystem Management Module Firmware< 1.06
LenovoThinkagile Hx Enclosure 7X81-
LenovoThinkagile Hx Enclosure 7Y87-
LenovoThinkagile Hx Enclosure 7Z02-
LenovoThinkagile Vx Enclosure 7Y11-
LenovoThinkagile Vx Enclosure 7Y91-
LenovoThinksystem D2 Enclosure 7X20-
LenovoThinksystem Modular Enclosure 7X22-

Related Weaknesses (CWE)

CWE-79

References

FAQ

What is CVE-2018-16096?

CVE-2018-16096 is a vulnerability with a CVSS score of 6.1 (MEDIUM). In System Management Module (SMM) versions prior to 1.06, the SMM web interface for changing Enclosure VPD fails to sufficiently sanitize all input for HTML tags, possibly opening a path for cross-sit...

How severe is CVE-2018-16096?

CVE-2018-16096 has been rated MEDIUM with a CVSS base score of 6.1/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2018-16096?

Check the references section above for vendor advisories and patch information. Affected products include: Lenovo System Management Module Firmware, Lenovo Thinkagile Hx Enclosure 7X81, Lenovo Thinkagile Hx Enclosure 7Y87, Lenovo Thinkagile Hx Enclosure 7Z02, Lenovo Thinkagile Vx Enclosure 7Y11.