{"id":"CVE-2019-6157","aliases":["EUVD-2019-15724","GHSA-jmrg-wp7g-g3wc"],"status":"published","title":"In various firmware versions of Lenovo System x, the integrated management module II (IMM2)'s...","description":"In various firmware versions of Lenovo System x, the integrated management module II (IMM2)'s first failure data capture (FFDC) includes the web server's private key in the generated log file for support.","severity":{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.01346,"percentile":0.71621,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-532"],"published":"2019-04-22T15:21:29Z","modified":"2026-06-17T02:38:41Z","products":[{"vendor":"ibm","product":"bladecenter_hs22_firmware"},{"vendor":"ibm","product":"bladecenter_hs23_firmware"},{"vendor":"ibm","product":"bladecenter_hs23e_firmware"},{"vendor":"ibm","product":"flex_system_x220_m4_firmware"},{"vendor":"ibm","product":"flex_system_x222_m4_firmware"},{"vendor":"ibm","product":"flex_system_x240_m4_firmware"},{"vendor":"ibm","product":"flex_system_x280_m4_firmware"},{"vendor":"ibm","product":"flex_system_x440_m4_firmware"},{"vendor":"ibm","product":"flex_system_x480_m4_firmware"},{"vendor":"ibm","product":"flex_system_x880_m4_firmware"},{"vendor":"ibm","product":"idataplex_dx360_m4_firmware"},{"vendor":"ibm","product":"idataplex_dx360_m4_water_cooled_firmware"},{"vendor":"ibm","product":"nextscale_nx360_m4_firmware"},{"vendor":"ibm","product":"system x"},{"vendor":"ibm","product":"system_x3100_m4_firmware"},{"vendor":"ibm","product":"system_x3100_m5_firmware"},{"vendor":"ibm","product":"system_x3250_m4_firmware"},{"vendor":"ibm","product":"system_x3250_m5_firmware"},{"vendor":"ibm","product":"system_x3300_m4_firmware"},{"vendor":"ibm","product":"system_x3500_m4_firmware"},{"vendor":"ibm","product":"system_x3530_m4_firmware"},{"vendor":"ibm","product":"system_x3550_m4_firmware"},{"vendor":"ibm","product":"system_x3630_m4_firmware"},{"vendor":"ibm","product":"system_x3650_m4_bd_firmware"},{"vendor":"ibm","product":"system_x3650_m4_firmware"},{"vendor":"ibm","product":"system_x3650_m4_hd_firmware"},{"vendor":"ibm","product":"system_x3750_m4_firmware"},{"vendor":"ibm","product":"system_x3850_x6_firmware"},{"vendor":"ibm","product":"system_x3950_x6_firmware"},{"vendor":"lenovo","product":"flex_system_x240_m4_firmware"},{"vendor":"lenovo","product":"flex_system_x240_m5_firmware"},{"vendor":"lenovo","product":"flex_system_x280_x6_firmware"},{"vendor":"lenovo","product":"flex_system_x440_m4_firmware"},{"vendor":"lenovo","product":"flex_system_x480_x6_firmware"},{"vendor":"lenovo","product":"flex_system_x880_firmware"},{"vendor":"lenovo","product":"nextscale_nx360_m5_firmware"},{"vendor":"lenovo","product":"system x"},{"vendor":"lenovo","product":"system_x3250_m6_firmware"},{"vendor":"lenovo","product":"system_x3500_m5_firmware"},{"vendor":"lenovo","product":"system_x3550_m5_firmware"},{"vendor":"lenovo","product":"system_x3650_m5_firmware"},{"vendor":"lenovo","product":"system_x3750_m4_firmware"},{"vendor":"lenovo","product":"system_x3850_x6_firmware"},{"vendor":"lenovo","product":"system_x3950_x6_firmware"}],"references":[{"url":"https://support.lenovo.com/solutions/LEN-25667","tags":["x_refsource_MISC","x_transferred","Patch","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-6157"},{"url":"https://github.com/advisories/GHSA-jmrg-wp7g-g3wc"}],"sources":{"cve":[{"id":"CVE-2019-6157","description":"In various firmware versions of Lenovo System x, the integrated management module II (IMM2)'s first failure data capture (FFDC) includes the web server's private key in the generated log file for support.","status":"published","published":"2019-04-22T15:21:29.692Z","modified":"2024-09-17T00:06:19.158Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","level":"medium","assessor":"cna"}],"updated_at":"2026-11-02T14:20:23.381621Z"}],"euvd":[{"id":"EUVD-2019-15724","description":"In various firmware versions of Lenovo System x, the integrated management module II (IMM2)'s first failure data capture (FFDC) includes the web server's private key in the generated log file for support.","status":"published","published":"2019-04-22T15:21:29Z","modified":"2024-09-17T00:06:19Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","level":"medium"}],"updated_at":"2026-11-03T00:29:01.977589Z"}],"ghsa":[{"id":"GHSA-jmrg-wp7g-g3wc","title":"In various firmware versions of Lenovo System x, the integrated management module II (IMM2)'s...","description":"In various firmware versions of Lenovo System x, the integrated management module II (IMM2)'s first failure data capture (FFDC) includes the web server's private key in the generated log file for support.","status":"published","published":"2022-05-24T16:44:08Z","modified":"2024-04-04T00:03:40Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T14:55:48.925076Z"}],"nvd":[{"id":"CVE-2019-6157","description":"In various firmware versions of Lenovo System x, the integrated management module II (IMM2)'s first failure data capture (FFDC) includes the web server's private key in the generated log file for support.","status":"published","published":"2019-04-22T16:29:02.037Z","modified":"2026-06-17T02:38:41.783Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","level":"medium","assessor":"secondary"},{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T14:05:12.471695Z"}]}}