Read the docs
TI-2020-06739 Aliases CVE-2020-8339GHSA-qw29-755q-4qgp

Insufficiently protected credentials in IBM BladeCenter AMM firmware

Priority LOW 28CWE-522Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Information disclosure, Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-522 and CWE-79.

Summary

A cross-site scripting inclusion (XSSI) vulnerability was reported in the legacy IBM BladeCenter Advanced Management Module (AMM) web interface prior to version 3.68n [BPET68N]. This vulnerability could allow an authenticated user's AMM credentials to be disclosed if the user is convinced to visit a malicious web site, possibly through phishing. Successful exploitation requires specific knowledge about the user’s network to be included in the malicious web site. Impact is limited to the normal access restrictions of the user visiting the malicious web site, and subject to the user being logged into AMM, being able to connect to both AMM and the malicious web site while the web browser is open, and using a web browser that does not inherently protect against this class of attack. The JavaScript code is not executed on AMM itself.

Why it matters now

EPSS 0.00669 52nd percentileScored 2026-11-07
Fix Fixed BladeCenter AMM firmware (IBM): 3.68n [BPET68N]

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
IBMBladeCenter AMM firmwarebefore 3.68n [BPET68N]3.68n [BPET68N]Patch availableCNA
  • BladeCenter AMM firmware VendorIBM Affected before 3.68n [BPET68N] Fixed in 3.68n [BPET68N] Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:o:ibm:bladecenter_advanced_management_module_firmware:*:*:*:*:*:*:*:*before 3.68nVulnerableIBM
cpe:2.3:h:ibm:bladecenter_advanced_management_module:-:*:*:*:*:*:*:*not specified by NVDRunning onIBM
  • cpe:2.3:o:ibm:bladecenter_advanced_management_module_firmware:*:*:*:*:*:*:*:* Versions before 3.68n Vulnerable ·IBM
  • cpe:2.3:h:ibm:bladecenter_advanced_management_module:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM

Remediation

  • Fix · CNA BladeCenter AMM firmware (IBM) Fixed in 3.68n [BPET68N]

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-8339
  2. 2026-10-03 Alias added: GHSA-qw29-755q-4qgp

References

Advisory 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences