Every CVE Search/ Get API key

CVE-2013-3609

The web interface in the Intelligent Platform Management Interface (IPMI) implementation on...

10.0 High

The web interface in the Intelligent Platform Management Interface (IPMI) implementation on Supermicro H8DC*, H8DG*, H8SCM-F, H8SGL-F, H8SM*, X7SP*, X8DT*, X8SI*, X9DAX-, X9DB, X9DR*, X9QR*, X9SBAA-F, X9SC*, X9SPU-F, and X9SR* devices relies on JavaScript code on the client for authorization checks, which allows remote authenticated users to bypass intended access restrictions via a crafted request, related to the PrivilegeCallBack function.

Exploit likelihood

5.31%Up 4.0 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 10.0

The web interface in the Intelligent Platform Management Interface (IPMI) implementation on Supermicro H8DC*, H8DG*, H8SCM-F, H8SGL-F, H8SM*, X7SP*, X8DT*, X8SI*, X9DAX-, X9DB, X9DR*, X9QR*, X9SBAA-F, X9SC*, X9SPU-F, and X9SR* devices relies on JavaScript code on the client for authorization checks, which allows remote authenticated users to bypass intended access restrictions via a crafted request, related to the PrivilegeCallBack function.

Record
CVE-2013-3609
CVSS 2.0
10.0 HighAV:N/AC:L/Au:N/C:C/I:C/A:C
Weakness
CWE-20
Updated
2026-11-02
CVE List No score

The web interface in the Intelligent Platform Management Interface (IPMI) implementation on Supermicro H8DC*, H8DG*, H8SCM-F, H8SGL-F, H8SM*, X7SP*, X8DT*, X8SI*, X9DAX-, X9DB, X9DR*, X9QR*, X9SBAA-F, X9SC*, X9SPU-F, and X9SR* devices relies on JavaScript code on the client for authorization checks, which allows remote authenticated users to bypass intended access restrictions via a crafted request, related to the PrivilegeCallBack function.

Record
CVE-2013-3609
Updated
2026-11-02
EUVDEUVD-2013-3543 No score

The web interface in the Intelligent Platform Management Interface (IPMI) implementation on Supermicro H8DC*, H8DG*, H8SCM-F, H8SGL-F, H8SM*, X7SP*, X8DT*, X8SI*, X9DAX-, X9DB, X9DR*, X9QR*, X9SBAA-F, X9SC*, X9SPU-F, and X9SR* devices relies on JavaScript code on the client for authorization checks, which allows remote authenticated users to bypass intended access restrictions via a crafted request, related to the PrivilegeCallBack function.

Record
EUVD-2013-3543
Updated
2026-11-03
GitHub AdvisoriesGHSA-479j-fq45-9438 No score

The web interface in the Intelligent Platform Management Interface (IPMI) implementation on...

The web interface in the Intelligent Platform Management Interface (IPMI) implementation on Supermicro H8DC*, H8DG*, H8SCM-F, H8SGL-F, H8SM*, X7SP*, X8DT*, X8SI*, X9DAX-, X9DB, X9DR*, X9QR*, X9SBAA-F, X9SC*, X9SPU-F, and X9SR* devices relies on JavaScript code on the client for authorization checks, which allows remote authenticated users to bypass intended access restrictions via a crafted request, related to the PrivilegeCallBack function.

Record
GHSA-479j-fq45-9438
Weakness
CWE-20
Updated
2026-11-02

Affected products

Show 121 moreShow less

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2013-3609 is a high vulnerability (CVSS 10.0) in Supermicro H8scm-f, published September 8, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 5.31%, the 92nd percentile. No source names a fixed version.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open