CVE-2022-42282 - NVIDIA BMC contains a vulnerability in SPX REST API, where an authorized attacker can access arbitrary files, which may lead to information disclosure · CoreCVE

Back Back to CVE browser

MEDIUM

NVIDIA BMC contains a vulnerability in SPX REST API, where an authorized attacker can access arbitrary files, which may lead to information disclosure

Published Jan 13, 2023

6.5

MEDIUM

CVSS 3.1

EPSS 0.48%

Description

NVIDIA BMC contains a vulnerability in SPX REST API, where an authorized attacker can access arbitrary files, which may lead to information disclosure.

Affected products

Vendor NVIDIA Product NVIDIA DGX servers Default
unaffected
- Version
  All BMC firmware versions prior to 00.19.07
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

NVIDIA DGX servers

unaffected

Version	Status	Constraints
All BMC firmware versions prior to 00.19.07	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-22

Path Traversal

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-45357
Advisory
https://nvidia.custhelp.com/app/answers/detail/a_id/5435
Vendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-45357		Advisory
https://nvidia.custhelp.com/app/answers/detail/a_id/5435		Vendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner nvidia

Published Jan 13, 2023

Updated Apr 7, 2025

Reserved Oct 3, 2022

Link CVE-2022-42282

CISA Vulnrichment

Updated Apr 7, 2025

Status Modified

Modified Jun 17, 2026

Link CVE-2022-42282

Severity n/a

Public date n/a

Links CVE-2022-42282

Assigner nvidia

Published Jan 13, 2023

Updated Apr 7, 2025

Exploited since n/a

Link EUVD-2022-45357

EUVD-2022-45357