What is CVE-2018-9071?

CVE-2018-9071 is a medium-severity vulnerability in Lenovo Chassis Management Module, classified under Information Disclosure. CVSS score: 5.3/10. Published 2018-11-16.

How severe is CVE-2018-9071?

Medium severity. CVSS v3 base score is 5.3 out of 10.

Information disclosure in Lenovo Chassis Management Module

CVE-2018-9071

Lenovo Chassis Management Module (CMM) prior to version 2.0.0 allows unauthenticated users to retrieve information related to the current authentication configuration settings. Exposed settings relate to password lengths, expiration, and lockout configuration.

Vulnerability class: Information Disclosure

EPSS: 0.010 (58.8th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N.

Affected products

Lenovo Chassis_management_module
Lenovo Chassis Management Module (Cmm) — versions unspecified
Lenovo Chassis_management_module_firmware

Weakness classification (CWE)

CWE-200 — Information Disclosure

References

psirt@lenovo.com (x_refsource_CONFIRM, Mitigation, Vendor Advisory)

Frequently asked questions

What is CVE-2018-9071?: CVE-2018-9071 is a medium-severity vulnerability in Lenovo Chassis Management Module, classified under Information Disclosure. CVSS score: 5.3/10. Published 2018-11-16.
How severe is CVE-2018-9071?: Medium severity. CVSS v3 base score is 5.3 out of 10.