CVE-2023-28411 — MEDIUM (6.3)

Q: What is CVE-2023-28411?

CVE-2023-28411 is a vulnerability with a CVSS score of 6.3 (MEDIUM). Double free in some Intel(R) Server Board BMC firmware before version 2.90 may allow a privileged user to enable information disclosure via local access.

Q: How severe is CVE-2023-28411?

CVE-2023-28411 has been rated MEDIUM with a CVSS base score of 6.3/10. Review the CVSS metrics above for detailed severity breakdown.

Q: Is there a patch for CVE-2023-28411?

Check the references section above for vendor advisories and patch information. Affected products include: Intel Server System D50Tnp1Mhcrlc Firmware, Intel Server System D50Tnp1Mhcrlc, Intel Server System D50Tnp1Mhcpac Firmware, Intel Server System D50Tnp1Mhcpac, Intel Server System D50Tnp2Mhsvac Firmware.

Vulnerability Description

Double free in some Intel(R) Server Board BMC firmware before version 2.90 may allow a privileged user to enable information disclosure via local access.

CVSS Score

6.3

MEDIUM

CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:L/I:H/A:N

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality

LOW

Integrity

HIGH

Availability

NONE

Affected Products

Vendor	Product	Versions
Intel	Server System D50Tnp1Mhcrlc Firmware	< 2.90
Intel	Server System D50Tnp1Mhcrlc	-
Intel	Server System D50Tnp1Mhcpac Firmware	< 2.90
Intel	Server System D50Tnp1Mhcpac	-
Intel	Server System D50Tnp2Mhsvac Firmware	< 2.90
Intel	Server System D50Tnp2Mhsvac	-
Intel	Server System D50Tnp2Mhstac Firmware	< 2.90
Intel	Server System D50Tnp2Mhstac	-
Intel	Server System D50Tnp1Mhcrac Firmware	< 2.90
Intel	Server System D50Tnp1Mhcrac	-
Intel	Server System D50Tnp2Mfalac Firmware	< 2.90
Intel	Server System D50Tnp2Mfalac	-
Intel	Server System M50Cyp1Ur204 Firmware	< 2.90
Intel	Server System M50Cyp1Ur204	-
Intel	Server System M50Cyp1Ur212 Firmware	< 2.90
Intel	Server System M50Cyp1Ur212	-
Intel	Server System M50Cyp2Ur312 Firmware	< 2.90
Intel	Server System M50Cyp2Ur312	-
Intel	Server System M50Cyp2Ur208 Firmware	< 2.90
Intel	Server System M50Cyp2Ur208	-

Related Weaknesses (CWE)

CWE-415

References

https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00839.PatchVendor Advisory
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00839.PatchVendor Advisory

FAQ

What is CVE-2023-28411?

CVE-2023-28411 is a vulnerability with a CVSS score of 6.3 (MEDIUM). Double free in some Intel(R) Server Board BMC firmware before version 2.90 may allow a privileged user to enable information disclosure via local access.

How severe is CVE-2023-28411?

CVE-2023-28411 has been rated MEDIUM with a CVSS base score of 6.3/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2023-28411?

Check the references section above for vendor advisories and patch information. Affected products include: Intel Server System D50Tnp1Mhcrlc Firmware, Intel Server System D50Tnp1Mhcrlc, Intel Server System D50Tnp1Mhcpac Firmware, Intel Server System D50Tnp1Mhcpac, Intel Server System D50Tnp2Mhsvac Firmware.