Details of VAR-201912-1823

ID

VAR-201912-1823

CVE

CVE-2019-11131

TITLE

Intel(R) AMT Vulnerability in Permission Management

Trust: 0.8

sources: JVNDB: JVNDB-2019-013693

DESCRIPTION

Logic issue in subsystem in Intel(R) AMT before versions 11.8.70, 11.11.70, 11.22.70 and 12.0.45 may allow an unauthenticated user to potentially enable escalation of privilege via network access. Intel(R) AMT Contains a privilege management vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Intel Active Management Technology (AMT) is a set of hardware-based computer remote active management technology software developed by Intel Corporation. A subsystem in Intel AMT has a security vulnerability. An attacker could exploit this vulnerability to elevate privileges. The following products and versions are affected: Intel AMT versions prior to 11.8.70, versions prior to 11.11.70, versions prior to 11.22.70, and versions prior to 12.0.45

Trust: 1.71

sources: NVD: CVE-2019-11131 // JVNDB: JVNDB-2019-013693 // VULHUB: VHN-142747

AFFECTED PRODUCTS

vendor:	intel	model:	active management technology	scope:	lt	version:	11.11.70	Trust: 1.8
vendor:	intel	model:	active management technology	scope:	lt	version:	11.22.70	Trust: 1.8
vendor:	intel	model:	active management technology	scope:	lt	version:	11.8.70	Trust: 1.8
vendor:	intel	model:	active management technology	scope:	lt	version:	12.0.45	Trust: 1.8
vendor:	intel	model:	active management technology	scope:	gte	version:	11.20	Trust: 1.0
vendor:	intel	model:	active management technology	scope:	gte	version:	12.0	Trust: 1.0
vendor:	intel	model:	active management technology	scope:	gte	version:	11.10	Trust: 1.0
vendor:	intel	model:	active management technology	scope:	gte	version:	11.0	Trust: 1.0

sources: JVNDB: JVNDB-2019-013693 // NVD: CVE-2019-11131

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2019-11131
value:	CRITICAL
Trust: 1.0
NVD:	CVE-2019-11131
value:	CRITICAL
Trust: 0.8
CNNVD:	CNNVD-201911-660
value:	CRITICAL
Trust: 0.6
VULHUB:	VHN-142747
value:	HIGH
Trust: 0.1

nvd@nist.gov:	CVE-2019-11131
severity:	HIGH
baseScore:	7.5
vectorString:	AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	10.0
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
VULHUB:	VHN-142747
severity:	HIGH
baseScore:	7.5
vectorString:	AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	10.0
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2019-11131
baseSeverity:	CRITICAL
baseScore:	9.8
vectorString:	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	3.9
impactScore:	5.9
version:	3.1
Trust: 1.0
NVD:	CVE-2019-11131
baseSeverity:	CRITICAL
baseScore:	9.8
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: VULHUB: VHN-142747 // JVNDB: JVNDB-2019-013693 // CNNVD: CNNVD-201911-660 // NVD: CVE-2019-11131

PROBLEMTYPE DATA

problemtype:	NVD-CWE-noinfo	Trust: 1.0
problemtype:	CWE-269	Trust: 0.8

sources: JVNDB: JVNDB-2019-013693 // NVD: CVE-2019-11131

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201911-660

TYPE

other

Trust: 0.6

sources: CNNVD: CNNVD-201911-660

CONFIGURATIONS

sources: JVNDB: JVNDB-2019-013693

PATCH

title:	INTEL-SA-00241	url:	https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00241.html	Trust: 0.8
title:	Intel Active Management Technology Security vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=106235	Trust: 0.6

sources: JVNDB: JVNDB-2019-013693 // CNNVD: CNNVD-201911-660

EXTERNAL IDS

db:	NVD	id:	CVE-2019-11131	Trust: 2.5
db:	JVN	id:	JVNVU90354904	Trust: 0.8
db:	JVNDB	id:	JVNDB-2019-013693	Trust: 0.8
db:	CNNVD	id:	CNNVD-201911-660	Trust: 0.7
db:	LENOVO	id:	LEN-27716	Trust: 0.6
db:	AUSCERT	id:	ESB-2020.2344	Trust: 0.6
db:	VULHUB	id:	VHN-142747	Trust: 0.1

sources: VULHUB: VHN-142747 // JVNDB: JVNDB-2019-013693 // CNNVD: CNNVD-201911-660 // NVD: CVE-2019-11131

REFERENCES

url:	https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00241.html	Trust: 1.7
url:	https://nvd.nist.gov/vuln/detail/cve-2019-11131	Trust: 1.4
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-11131	Trust: 0.8
url:	https://jvn.jp/vu/jvnvu90354904/	Trust: 0.8
url:	https://vigilance.fr/vulnerability/intel-csme-amt-dal-sps-txe-multiple-vulnerabilities-31014	Trust: 0.6
url:	https://support.lenovo.com/us/en/product_security/len-27716	Trust: 0.6
url:	https://www.auscert.org.au/bulletins/esb-2020.2344/	Trust: 0.6

sources: VULHUB: VHN-142747 // JVNDB: JVNDB-2019-013693 // CNNVD: CNNVD-201911-660 // NVD: CVE-2019-11131

SOURCES

db:	VULHUB	id:	VHN-142747
db:	JVNDB	id:	JVNDB-2019-013693
db:	CNNVD	id:	CNNVD-201911-660
db:	NVD	id:	CVE-2019-11131

LAST UPDATE DATE

2024-11-23T21:01:00.083000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-142747	date:	2020-08-24T00:00:00
db:	JVNDB	id:	JVNDB-2019-013693	date:	2020-01-14T00:00:00
db:	CNNVD	id:	CNNVD-201911-660	date:	2020-08-25T00:00:00
db:	NVD	id:	CVE-2019-11131	date:	2024-11-21T04:20:35.260

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-142747	date:	2019-12-18T00:00:00
db:	JVNDB	id:	JVNDB-2019-013693	date:	2020-01-14T00:00:00
db:	CNNVD	id:	CNNVD-201911-660	date:	2019-11-12T00:00:00
db:	NVD	id:	CVE-2019-11131	date:	2019-12-18T22:15:13.283