CVEvulnerability

CVE-2010-2654

4.3 MEDIUM Published 2010-07-08 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2010-07-08
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:N
Weaknesses
CWE-79

Description

Multiple cross-site scripting (XSS) vulnerabilities on the IBM BladeCenter with Advanced Management Module (AMM) firmware build ID BPET48L, and possibly other versions before 4.7 and 5.0, allow remote attackers to inject arbitrary web script or HTML via the (1) INDEX or (2) IPADDR parameter to private/cindefn.php, (3) the domain parameter to private/power_management_policy_options.php, the slot parameter to (4) private/pm_temp.php or (5) private/power_module.php, (6) the WEBINDEX parameter to private/blade_leds.php, or (7) the SLOT parameter to private/ipmi_bladestatus.php.

Affected configurations

• ibm advanced management module (<= 2.48) • ibm advanced management module (<= 3.54) • ibm advanced management module 1.00 • ibm advanced management module 1.01 • ibm advanced management module 1.20 • ibm advanced management module 1.25 • ibm advanced management module 1.26 • ibm advanced management module 1.28 • ibm advanced management module 1.32 • ibm advanced management module 1.34 • ibm advanced management module 1.36 • ibm advanced management module 1.42 • ibm advanced management module 2.46 • ibm advanced management module 2.48 • ibm advanced management module 2.50 • ibm advanced management module 3.54

Related

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References