Skip to content
Sign in
6.5 Medium

CVE-2022-3287 When creating an OPERATOR user account on the BMC, the redfish plugin saved the auto-generated password to…

Description

When creating an OPERATOR user account on the BMC, the redfish plugin saved the auto-generated password to /etc/fwupd/redfish.conf without proper restriction, allowing any user on the system to read the same configuration file.

Affected products and versions

Product Affected versions Fixed in
fwupd Versions not published

Other CVEs of fwupd

The 2 CVEs of fwupd →
CVE-2020-10759 A PGP signature bypass flaw was found in fwupd (all versions), which could lead to the installation of unsigned firmware Not rated
Track this CVE