The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2023:7189 advisory.

  - When creating an OPERATOR user account on the BMC, the redfish plugin saved the auto-generated password to     /etc/fwupd/redfish.conf without proper restriction, allowing any user on the system to read the same     configuration file. (CVE-2022-3287)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Detections

Analytics

Rocky Linux 8 : fwupd (RLSA-2023:7189)

medium Nessus Plugin ID 186395

Version 1.0