var-201809-1073
Vulnerability from variot
A vulnerability in a subsystem in Intel CSME before version 11.21.55, Intel Server Platform Services before version 4.0 and Intel Trusted Execution Engine Firmware before version 3.1.55 may allow an unauthenticated user to potentially modify or disclose information via physical access. Multiple Intel Products are prone to a local privilege-escalation vulnerability. An attacker can exploit this issue to potentially modify or disclose sensitive information. This may lead to further attacks. Intel CSME is a converged security management engine. Intel Trusted Execution Engine is a trusted execution engine with hardware authentication function used in CPU (Central Processing Unit)
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201809-1073",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "converged security management engine",
"scope": "lte",
"trust": 1.0,
"vendor": "intel",
"version": "11.11.50"
},
{
"model": "server platform services",
"scope": "lt",
"trust": 1.0,
"vendor": "intel",
"version": "4.0"
},
{
"model": "converged security management engine",
"scope": "gte",
"trust": 1.0,
"vendor": "intel",
"version": "11.10"
},
{
"model": "trusted execution engine",
"scope": "gte",
"trust": 1.0,
"vendor": "intel",
"version": "3.0"
},
{
"model": "trusted execution engine",
"scope": "lte",
"trust": 1.0,
"vendor": "intel",
"version": "3.1.50"
},
{
"model": "converged security management engine",
"scope": "gte",
"trust": 1.0,
"vendor": "intel",
"version": "11.20"
},
{
"model": "converged security management engine",
"scope": "lte",
"trust": 1.0,
"vendor": "intel",
"version": "11.21.51"
},
{
"model": "converged security management engine",
"scope": "lte",
"trust": 1.0,
"vendor": "intel",
"version": "11.8.50"
},
{
"model": "converged security management engine",
"scope": "gte",
"trust": 1.0,
"vendor": "intel",
"version": "11.0"
},
{
"model": "csme",
"scope": "lt",
"trust": 0.8,
"vendor": "intel",
"version": "11.21.55"
},
{
"model": "server platform services",
"scope": "lt",
"trust": 0.8,
"vendor": "intel",
"version": "11.21.55"
},
{
"model": "trusted execution engine",
"scope": "lt",
"trust": 0.8,
"vendor": "intel",
"version": "3.1.55"
},
{
"model": "trusted execution engine",
"scope": "eq",
"trust": 0.3,
"vendor": "intel",
"version": "3.1.50.2222"
},
{
"model": "trusted execution engine",
"scope": "eq",
"trust": 0.3,
"vendor": "intel",
"version": "3.0"
},
{
"model": "server platform services sps soc-x 04.00.04.0",
"scope": null,
"trust": 0.3,
"vendor": "intel",
"version": null
},
{
"model": "server platform services sps soc-a 04.00.04.1",
"scope": null,
"trust": 0.3,
"vendor": "intel",
"version": null
},
{
"model": "server platform services sps e5 04.00.04.340.",
"scope": null,
"trust": 0.3,
"vendor": "intel",
"version": null
},
{
"model": "converged security management engine",
"scope": "eq",
"trust": 0.3,
"vendor": "intel",
"version": "11.8.50.3399"
},
{
"model": "converged security management engine",
"scope": "eq",
"trust": 0.3,
"vendor": "intel",
"version": "11.21.50.1400"
},
{
"model": "converged security management engine",
"scope": "eq",
"trust": 0.3,
"vendor": "intel",
"version": "11.20"
},
{
"model": "converged security management engine",
"scope": "eq",
"trust": 0.3,
"vendor": "intel",
"version": "11.11.50.1402"
},
{
"model": "converged security management engine",
"scope": "eq",
"trust": 0.3,
"vendor": "intel",
"version": "11.10"
},
{
"model": "converged security management engine",
"scope": "eq",
"trust": 0.3,
"vendor": "intel",
"version": "11.0"
},
{
"model": "trusted execution engine",
"scope": "ne",
"trust": 0.3,
"vendor": "intel",
"version": "3.1.55"
},
{
"model": "server platform services sps soc-a 04.00.04.1",
"scope": "ne",
"trust": 0.3,
"vendor": "intel",
"version": null
},
{
"model": "server platform services sps soc-a 04.00.04.0",
"scope": "ne",
"trust": 0.3,
"vendor": "intel",
"version": null
},
{
"model": "server platform services sps e5 04.00.04.381.",
"scope": "ne",
"trust": 0.3,
"vendor": "intel",
"version": null
},
{
"model": "converged security management engine",
"scope": "ne",
"trust": 0.3,
"vendor": "intel",
"version": "11.21.55"
},
{
"model": "converged security management engine",
"scope": "ne",
"trust": 0.3,
"vendor": "intel",
"version": "11.11.55"
},
{
"model": "converged security management engine",
"scope": "ne",
"trust": 0.3,
"vendor": "intel",
"version": "11.8.55"
}
],
"sources": [
{
"db": "BID",
"id": "105793"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-008423"
},
{
"db": "NVD",
"id": "CVE-2018-3655"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/o:intel:csme_firmware",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:intel:server_platform_services_firmware",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:intel:trusted_execution_engine_firmware",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2018-008423"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Dmitry Sklyarov and Maxim Goryachy from Positive Technologies",
"sources": [
{
"db": "BID",
"id": "105793"
}
],
"trust": 0.3
},
"cve": "CVE-2018-3655",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 3.6,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 3.9,
"id": "CVE-2018-3655",
"impactScore": 4.9,
"integrityImpact": "PARTIAL",
"severity": "LOW",
"trust": 1.9,
"vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "NONE",
"baseScore": 3.6,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 3.9,
"id": "VHN-133686",
"impactScore": 4.9,
"integrityImpact": "PARTIAL",
"severity": "LOW",
"trust": 0.1,
"vectorString": "AV:L/AC:L/AU:N/C:P/I:P/A:N",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "PHYSICAL",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 0.9,
"id": "CVE-2018-3655",
"impactScore": 5.8,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"trust": 1.8,
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2018-3655",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "NVD",
"id": "CVE-2018-3655",
"trust": 0.8,
"value": "High"
},
{
"author": "CNNVD",
"id": "CNNVD-201809-606",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "VULHUB",
"id": "VHN-133686",
"trust": 0.1,
"value": "LOW"
},
{
"author": "VULMON",
"id": "CVE-2018-3655",
"trust": 0.1,
"value": "LOW"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-133686"
},
{
"db": "VULMON",
"id": "CVE-2018-3655"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-008423"
},
{
"db": "CNNVD",
"id": "CNNVD-201809-606"
},
{
"db": "NVD",
"id": "CVE-2018-3655"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "A vulnerability in a subsystem in Intel CSME before version 11.21.55, Intel Server Platform Services before version 4.0 and Intel Trusted Execution Engine Firmware before version 3.1.55 may allow an unauthenticated user to potentially modify or disclose information via physical access. Multiple Intel Products are prone to a local privilege-escalation vulnerability. \nAn attacker can exploit this issue to potentially modify or disclose sensitive information. This may lead to further attacks. Intel CSME is a converged security management engine. Intel Trusted Execution Engine is a trusted execution engine with hardware authentication function used in CPU (Central Processing Unit)",
"sources": [
{
"db": "NVD",
"id": "CVE-2018-3655"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-008423"
},
{
"db": "BID",
"id": "105793"
},
{
"db": "VULHUB",
"id": "VHN-133686"
},
{
"db": "VULMON",
"id": "CVE-2018-3655"
}
],
"trust": 2.07
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2018-3655",
"trust": 2.9
},
{
"db": "JVNDB",
"id": "JVNDB-2018-008423",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201809-606",
"trust": 0.7
},
{
"db": "BID",
"id": "105793",
"trust": 0.3
},
{
"db": "VULHUB",
"id": "VHN-133686",
"trust": 0.1
},
{
"db": "VULMON",
"id": "CVE-2018-3655",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-133686"
},
{
"db": "VULMON",
"id": "CVE-2018-3655"
},
{
"db": "BID",
"id": "105793"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-008423"
},
{
"db": "CNNVD",
"id": "CNNVD-201809-606"
},
{
"db": "NVD",
"id": "CVE-2018-3655"
}
]
},
"id": "VAR-201809-1073",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-133686"
}
],
"trust": 0.755303
},
"last_update_date": "2024-11-23T23:12:02.872000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "INTEL-SA-00125",
"trust": 0.8,
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00125.html"
},
{
"title": "Intel CSME , Intel Server Platform Services and Intel Trusted Execution Engine Subsystem security vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=84865"
},
{
"title": "HP: HPSBHF03592 rev. 3 - Intel Converged Security and Management Engine (CSME) and Power Management Controller (PMC) Security Updates",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=hp_bulletin\u0026qid=HPSBHF03592"
}
],
"sources": [
{
"db": "VULMON",
"id": "CVE-2018-3655"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-008423"
},
{
"db": "CNNVD",
"id": "CNNVD-201809-606"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "NVD-CWE-noinfo",
"trust": 1.0
},
{
"problemtype": "CWE-264",
"trust": 0.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-133686"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-008423"
},
{
"db": "NVD",
"id": "CVE-2018-3655"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.5,
"url": "https://support.hpe.com/hpsc/doc/public/display?doclocale=en_us\u0026docid=emr_na-hpesbhf03873en_us"
},
{
"trust": 2.1,
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00125.html"
},
{
"trust": 1.8,
"url": "https://security.netapp.com/advisory/ntap-20180924-0003/"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-3655"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-3655"
},
{
"trust": 0.3,
"url": "http://www.intel.com/"
},
{
"trust": 0.1,
"url": "https://support.hpe.com/hpsc/doc/public/display?doclocale=en_us\u0026amp;docid=emr_na-hpesbhf03873en_us"
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
},
{
"trust": 0.1,
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/149866"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-133686"
},
{
"db": "VULMON",
"id": "CVE-2018-3655"
},
{
"db": "BID",
"id": "105793"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-008423"
},
{
"db": "CNNVD",
"id": "CNNVD-201809-606"
},
{
"db": "NVD",
"id": "CVE-2018-3655"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-133686"
},
{
"db": "VULMON",
"id": "CVE-2018-3655"
},
{
"db": "BID",
"id": "105793"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-008423"
},
{
"db": "CNNVD",
"id": "CNNVD-201809-606"
},
{
"db": "NVD",
"id": "CVE-2018-3655"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2018-09-12T00:00:00",
"db": "VULHUB",
"id": "VHN-133686"
},
{
"date": "2018-09-12T00:00:00",
"db": "VULMON",
"id": "CVE-2018-3655"
},
{
"date": "2018-09-11T00:00:00",
"db": "BID",
"id": "105793"
},
{
"date": "2018-10-16T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2018-008423"
},
{
"date": "2018-09-13T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201809-606"
},
{
"date": "2018-09-12T19:29:02.683000",
"db": "NVD",
"id": "CVE-2018-3655"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2019-10-03T00:00:00",
"db": "VULHUB",
"id": "VHN-133686"
},
{
"date": "2019-10-03T00:00:00",
"db": "VULMON",
"id": "CVE-2018-3655"
},
{
"date": "2018-09-11T00:00:00",
"db": "BID",
"id": "105793"
},
{
"date": "2018-10-16T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2018-008423"
},
{
"date": "2019-10-23T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201809-606"
},
{
"date": "2024-11-21T04:05:50.727000",
"db": "NVD",
"id": "CVE-2018-3655"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "local",
"sources": [
{
"db": "BID",
"id": "105793"
},
{
"db": "CNNVD",
"id": "CNNVD-201809-606"
}
],
"trust": 0.9
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "plural Intel Vulnerabilities related to authorization, authority, and access control in products",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2018-008423"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "permissions and access control issues",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201809-606"
}
],
"trust": 0.6
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.