The OpenBMC Project
First CVE: Oct 27, 2022Active for: 4 years
2
CVEs Published
More CVEs Published than 6% of tracked CNAs
2.0
Avg CVEs / Year
More Avg CVEs / Year than 11% of tracked CNAs
7.5
Avg CVSS Score
Higher Avg CVSS Score than 68% of tracked CNAs
0.0%
In CISA KEV
Bottom 1%
Trends Over Time
The number and severity of CVEs published by The OpenBMC Project over time
Volume of CVEsAvg CVSS Base Score
First CVE
Oct 27, 2022
3 years ago
Most Recent CVE
Oct 27, 2022
1,366 days ago
Top CVEs
All CVEs published by The OpenBMC Project as a CNA, regardless of affected vendor or product.
2 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2022-3409HIGH A vulnerability in bmcweb of OpenBMC Project allows user to cause denial of service. This vulnerability was identified during mitigation for CVE-2022-2809. When fuzzing the multipa | Oct 27, 2022 | 7.5 | 25 | NO | NO |
CVE-2022-2809HIGH A vulnerability in bmcweb of OpenBMC Project allows user to cause denial of service. When fuzzing the multipart_parser code using AFL++ with address sanitizer enabled to find small | Oct 27, 2022 | 7.5 | 25 | NO | NO |
CVE Severity & Scoring
Severity distribution of CVEs published by this CNA2 CVEs
100%
Severity distribution among all CVEs352,231 CVEs
45%
40%
11%
High
Attack Vector
Local0 (0.0%)
Network2 (100.0%)
Unknown0 (0.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low2 (100.0%)
High0 (0.0%)
Unknown0 (0.0%)
User Interaction
None2 (100.0%)
Unknown0 (0.0%)
Required0 (0.0%)
Privileges Required
Low0 (0.0%)
High0 (0.0%)
None2 (100.0%)
Unknown0 (0.0%)
Exploit Exposure
Signals from CVEs in this cna scope (2 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
0 CVEs
0.0% of CVEs· Bottom 1%
Social Chatter
An overview of all social media posts that mention a CVE ID published by The OpenBMC Project as a CNA.
Media Mentions
Media articles that mention a CVE ID published by The OpenBMC Project as a CNA — matched by CVE ID, not by organization name.