Lucene search

IntelCVE-2019-0090

HistoryMay 17, 2019 - 4:29 p.m.

CVE-2019-0090

2019-05-1716:29:00

intel

web.nvd.nist.gov

148

cve-2019-0090

vulnerability

intel csme

txe

sps

access control

privilege escalation

nvd

CVSS2

4.4

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:M/Au:N/C:P/I:P/A:P

CVSS3

7.1

Attack Vector

PHYSICAL

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

AI Score

7.3

Confidence

High

EPSS

0.001

Percentile

33.3%

JSON

Insufficient access control vulnerability in subsystem for Intel® CSME before versions 11.x, 12.0.35 Intel® TXE 3.x, 4.x, Intel® Server Platform Services 3.x, 4.x, Intel® SPS before version SPS_E3_05.00.04.027.0 may allow an unauthenticated user to potentially enable escalation of privilege via physical access.

Affected configurations

Nvd

Node

intelconverged_security_and_management_engineRange<12.0.35

Node

intelserver_platform_servicesRange<sps_e3_05.00.04.027.0

VendorProductVersionCPE
intelconverged_security_and_management_engine*cpe:2.3:a:intel:converged_security_and_management_engine:*:*:*:*:*:*:*:*
intelserver_platform_services*cpe:2.3:a:intel:server_platform_services:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
intel	converged_security_and_management_engine	*	cpe:2.3:a:intel:converged_security_and_management_engine::::::::
intel	server_platform_services	*	cpe:2.3:a:intel:server_platform_services::::::::

CNA Affected

[
  {
    "product": "Intel(R) Converged Security & Management Engine (CSME), Intel(R) Server Platform Services (SPS)",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "CSME before version 12.0.35, Intel(R) SPS before version SPS_E3_05.00.04.027.0"
      }
    ]
  }
]