CVE-2022-42278
published 2023-01-13CVE-2022-42278: NVIDIA BMC contains a vulnerability in SPX REST API, where an authorized attacker can read and write to arbitrary locations within the memory context of the…
PriorityP342high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.57%
43.5th percentile
NVIDIA BMC contains a vulnerability in SPX REST API, where an authorized attacker can read and write to arbitrary locations within the memory context of the IPMI server process, which may lead to code execution, denial of service, information disclosure and data tampering.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| nvidia | bmc | < 00.19.07 | 00.19.07 |
| nvidia | nvidia_dgx_servers | — | — |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
cisa7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-chmh-mcvp-rwfv: NVIDIA BMC contains a vulnerability in SPX REST API, where an authorized attacker can read and write to arbitrary locations within the memory context
ghsa_unreviewed·2023-01-13
CVE-2022-42278 [HIGH] GHSA-chmh-mcvp-rwfv: NVIDIA BMC contains a vulnerability in SPX REST API, where an authorized attacker can read and write to arbitrary locations within the memory context
NVIDIA BMC contains a vulnerability in SPX REST API, where an authorized attacker can read and write to arbitrary locations within the memory context of the IPMI server process, which may lead to code execution, denial of service, information disclosure and data tampering.
CISA
Microsoft Active Directory Domain Services Privilege Escalation Vulnerability
cisa·2022-04-11·CVSS 7.5
CVE-2021-42278 [HIGH] CWE-20 Microsoft Active Directory Domain Services Privilege Escalation Vulnerability
Vulnerability: Microsoft Active Directory Domain Services Privilege Escalation Vulnerability
Affected: Microsoft Active Directory
Microsoft Active Directory Domain Services contains an unspecified vulnerability that allows for privilege escalation.
Required Action: Apply updates per vendor instructions.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2021-42278
Remediation Due Date: 2022-05-02
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2023-01-13
Published