CVE-2020-8339

A cross-site scripting inclusion (XSSI) vulnerability was reported in the legacy IBM BladeCenter Advanced Management Module (AMM) web interface prior to version 3.68n [BPET68N]. This vulnerability could allow an authenticated user's AMM credentials to be disclosed if the user is convinced to visit a malicious web site, possibly through phishing. Successful exploitation requires specific knowledge about the user’s network to be included in the malicious web site. Impact is limited to the normal access restrictions of the user visiting the malicious web site, and subject to the user being logged into AMM, being able to connect to both AMM and the malicious web site while the web browser is open, and using a web browser that does not inherently protect against this class of attack. The JavaScript code is not executed on AMM itself.

• CWE-522
• CWE-79

• https://support.lenovo.com/us/en/product_security/LEN-38385Third Party Advisory
• https://support.lenovo.com/us/en/product_security/LEN-38385Third Party Advisory

Published

Sep 15, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-8333A potential vulnerability in the SMI callback function used …7.8
• CVE-2020-8334The BIOS tamper detection mechanism was not triggered in Len…6.8
• CVE-2020-8335The BIOS tamper detection mechanism was not triggered in Len…6.8
• CVE-2020-8336Lenovo implemented Intel CSME Anti-rollback ARB protections …6.8
• CVE-2020-8337An unquoted search path vulnerability was reported in versio…6.7
• CVE-2020-8338A DLL search path vulnerability was reported in Lenovo Diagn…7.8
• CVE-2020-8340A cross-site scripting (XSS) vulnerability was discovered in…6.1
• CVE-2020-8341In Lenovo systems, SMM BIOS Write Protection is used to prev…2.4
• CVE-2020-8342A race condition vulnerability was reported in Lenovo System…7
• CVE-2020-8343Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2020-8344Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2020-8345A DLL search path vulnerability was reported in the Lenovo H…7.8