What is the CVSS score of CVE-2019-6159?

CVE-2019-6159 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 1.1%.

Bladecenter Hs22 Firmware CVE-2019-6159

MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2019-08-19 psirt@lenovo.com

XSS IBM Bladecenter Hs22 Firmware Bladecenter Hs22V Firmware Bladecenter Hx5 Firmware System X Idataplex Dx360 M2 Firmware System X Idataplex Dx360 M3 Firmware System X3400 M3 Firmware System X3500 M2 Firmware System X3500 M3 Firmware System X3550 M3 Firmware System X3560 M2 Firmware System X3630 M3 Firmware System X3650 M3 Firmware System X3690 X5 Firmware System X3850 X5 Firmware System X3950 X5 Firmware

6.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

CVE Published

Aug 19, 2019 - 15:15 nvd

MEDIUM 6.1

DescriptionNVD

A stored cross-site scripting (XSS) vulnerability exists in various firmware versions of the legacy IBM System x IMM (IMM v1) embedded Baseboard Management Controller (BMC). This vulnerability could allow an unauthenticated user to cause JavaScript code to be stored in the IMM log which may then be executed in the user's web browser when IMM log records containing the JavaScript code are viewed. The JavaScript code is not executed on IMM itself. The later IMM2 (IMM v2) is not affected.

AnalysisAI

A stored cross-site scripting (XSS) vulnerability exists in various firmware versions of the legacy IBM System x IMM (IMM v1) embedded Baseboard Management Controller (BMC). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Cross-Site Scripting (XSS) (CWE-79), which allows attackers to inject malicious scripts into web pages viewed by other users. A stored cross-site scripting (XSS) vulnerability exists in various firmware versions of the legacy IBM System x IMM (IMM v1) embedded Baseboard Management Controller (BMC). This vulnerability could allow an unauthenticated user to cause JavaScript code to be stored in the IMM log which may then be executed in the user's web browser when IMM log records containing the JavaScript code are viewed. The JavaScript code is not executed on IMM itself. The later IMM2 (IMM v2) is not affected. Affected products include: Lenovo Bladecenter Hs22 Firmware, Lenovo Bladecenter Hs22V Firmware, Lenovo Bladecenter Hx5 Firmware, Lenovo System X Idataplex Dx360 M2 Firmware, Lenovo System X Idataplex Dx360 M3 Firmware.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Sanitize all user input, use Content-Security-Policy headers, encode output contextually (HTML, JS, URL). Use frameworks with built-in XSS protection.