description: AMI BMC contains a vulnerability in the SPX REST API, where an
attacker with the required privileges can inject arbitrary shell commands,
which may lead to code execution, denial of service, information disclosure, or
data tampering.
problem types: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
affected:
{
defaultStatus: unknown
platforms: ARM
product: MegaRAC_SPx
vendor: AMI
versions:
lessThan: 12.7, status: affected, version: 12.0, versionType: RC
lessThan: 13.5, status: affected, version: 13.0, versionType: RC
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL