4.0
MEDIUM
CVE-2013-4038
IBM IPMI Cleartext Password Storage Vulnerability
Description

The Intelligent Platform Management Interface (IPMI) implementation in Integrated Management Module (IMM) on IBM BladeCenter, Flex System, System x iDataPlex, and System x3### servers uses cleartext for password storage, which allows context-dependent attackers to obtain sensitive information by reading a file.

INFO

Published Date :

Aug. 9, 2013, 11:55 p.m.

Last Modified :

Nov. 21, 2024, 1:54 a.m.

Remotely Exploitable :

Yes !

Impact Score :

2.9

Exploitability Score :

8.0
Affected Products

The following products are affected by CVE-2013-4038 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID Vendor Product Action
1 Ibm bladecenter
2 Ibm flex_system_x220_compute_node
3 Ibm flex_system_x240_compute_node
4 Ibm flex_system_x440_compute_node
5 Ibm system_x_idataplex_dx360_m4_server
6 Ibm system_x3100_m4
7 Ibm system_x3250_m4
8 Ibm system_x3500_m2
9 Ibm system_x3500_m3
10 Ibm system_x3500_m4
11 Ibm system_x3530_m4
12 Ibm system_x3550_m2
13 Ibm system_x3550_m3
14 Ibm system_x3550_m4
15 Ibm system_x3630_m3
16 Ibm system_x3630_m4
17 Ibm system_x3650_m2
18 Ibm system_x3650_m3
19 Ibm system_x3650_m4
20 Ibm system_x3690_x5
21 Ibm system_x3750_m4
22 Ibm system_x3850_x5
23 Ibm system_x3950_x5
24 Ibm system_x_idataplex_dx360_m2_server
25 Ibm system_x_idataplex_dx360_m3_server
26 Ibm system_x3200_m3
27 Ibm system_x3250_m3
28 Ibm system_x3400_m2
29 Ibm system_x3400_m3
30 Ibm system_x3620_m3
References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2013-4038.

URL Resource
http://www.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5093463 Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/86174
http://www.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5093463 Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/86174

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2013-4038 vulnerability anywhere in the article.

The following table lists the changes that have been made to the CVE-2013-4038 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

  • CVE Modified by af854a3a-2127-422b-91ae-364da2661108

    Nov. 21, 2024

    Action Type Old Value New Value
    Added Reference http://www.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5093463
    Added Reference https://exchange.xforce.ibmcloud.com/vulnerabilities/86174
  • CVE Modified by [email protected]

    May. 14, 2024

    Action Type Old Value New Value
  • CVE Modified by [email protected]

    Aug. 29, 2017

    Action Type Old Value New Value
    Removed Reference http://xforce.iss.net/xforce/xfdb/86174 [No Types Assigned]
    Added Reference https://exchange.xforce.ibmcloud.com/vulnerabilities/86174 [No Types Assigned]
  • Initial Analysis by [email protected]

    Aug. 12, 2013

    Action Type Old Value New Value
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.
CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2013-4038 is associated with the following CWEs:

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2013-4038 weaknesses.

Exploit Prediction

EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days.

0.13 }} -0.00%

score

0.48140

percentile

CVSS2 - Vulnerability Scoring System
Access Vector
Access Complexity
Authentication
Confidentiality
Integrity
Availability