CVE-2010-2656 Information disclosure in n/a

Medium 5.0 Published 7 Jul 2010 Updated 7 Aug 2024

Remote attackers can download sensitive logs and core files from IBM BladeCenter AMM firmware due to insufficient access control on web root files.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2010-2656?

CVE-2010-2656 is a medium-severity vulnerability in n/a, published on 7 Jul 2010. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The IBM BladeCenter with Advanced Management Module (AMM) firmware build ID BPET48L, and possibly other versions before 4.7 and 5.0, stores sensitive information under the web root with insufficient access control, which allows remote attackers to download (1) logs or (2) core files via direct requests, as demonstrated by a request for private/sdc.tgz.

Weakness: CWE-264

Which versions are affected by CVE-2010-2656?

It affects 1 product.

Products include Ibm Advanced Management Module.

How do I fix CVE-2010-2656?

No fix has been published for CVE-2010-2656 yet. Limit exposure of the affected software until one is available.

Is CVE-2010-2656 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2010-2656 exists.

Public exploit code: 1 Exploit-DB entry.

Sources

Also known as GHSA-2424-x5j2-7rx4.