CVE-2023-33411 Path traversal in n/a

High 7.5 Published 7 Dec 2023 Updated 9 Jul 2026

Remote unauthenticated attackers can perform directory traversal on Supermicro BMC web servers to disclose sensitive information.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-33411?

CVE-2023-33411 is a high-severity path traversal vulnerability in n/a, published on 7 Dec 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A web server in the Intelligent Platform Management Interface (IPMI) baseboard management controller (BMC) implementation on Supermicro X11 and M11 based devices, with firmware versions up to 3.17.02, allows remote unauthenticated users to perform directory traversal, potentially disclosing sensitive information.

Weakness: CWE-22

Which versions are affected by CVE-2023-33411?

It affects 362 products.

Products include Supermicro B12dpe-6 Firmware, Supermicro B12dpt-6 Firmware, Supermicro B12spe-Cpu-25g Firmware, Supermicro B13dee Firmware, Supermicro B13det Firmware, Supermicro B13see-Cpu-25g Firmware and 356 more.

How do I fix CVE-2023-33411?

No fix has been published for CVE-2023-33411 yet. Limit exposure of the affected software until one is available.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2023-33411 being exploited?

There is no known exploitation of CVE-2023-33411 in the wild and no public exploit code.

Sources

Also known as GHSA-7675-h57g-r24m.