Riskcovery

CVE-2023-34329

Authentication Bypass via HTTP Header Spoofing

State
Published
Severity
9.1 Critical
Published
Jul 18, 2023
Updated
Feb 13, 2025
Reserved
Jun 1, 2023

Read the record on cve.org

Description

AMI MegaRAC SPx12 contains a vulnerability in BMC where a User may cause an authentication bypass by spoofing the HTTP header. A successful exploit of this vulnerability may lead to loss of confidentiality, integrity, and availability.

Scores

CVSSScoreVectorSource
3.19.1 CriticalCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:HAMI
3.18.4 HighCVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:HAMI

Weaknesses

  • CWE-306 Missing Authentication for Critical Function
  • CWE-290 Authentication Bypass by Spoofing

Affected Products

ProductVersions
MegaRAC_SPx12AMI
  • 12.0 to before 12.4Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.