CVE-2020-8340

A cross-site scripting (XSS) vulnerability was discovered in the legacy IBM and Lenovo System x IMM2 (Integrated Management Module 2), prior to version 5.60, embedded Baseboard Management Controller (BMC) web interface during an internal security review. This vulnerability could allow JavaScript code to be executed in the user's web browser if the user is convinced to visit a crafted URL, possibly through phishing. Successful exploitation requires specific knowledge about the user’s network to be included in the crafted URL. Impact is limited to the normal access restrictions and permissions of the user clicking the crafted URL, and subject to the user being able to connect to and already being authenticated to IMM2 or other systems. The JavaScript code is not executed on IMM2 itself.

• CWE-79
• CWE-79

• https://support.lenovo.com/us/en/product_security/LEN-44717Vendor Advisory
• https://support.lenovo.com/us/en/product_security/LEN-44717Vendor Advisory

Published

Sep 15, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-8334The BIOS tamper detection mechanism was not triggered in Len…6.8
• CVE-2020-8335The BIOS tamper detection mechanism was not triggered in Len…6.8
• CVE-2020-8336Lenovo implemented Intel CSME Anti-rollback ARB protections …6.8
• CVE-2020-8337An unquoted search path vulnerability was reported in versio…6.7
• CVE-2020-8338A DLL search path vulnerability was reported in Lenovo Diagn…7.8
• CVE-2020-8339A cross-site scripting inclusion (XSSI) vulnerability was re…6.1
• CVE-2020-8341In Lenovo systems, SMM BIOS Write Protection is used to prev…2.4
• CVE-2020-8342A race condition vulnerability was reported in Lenovo System…7
• CVE-2020-8343Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2020-8344Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2020-8345A DLL search path vulnerability was reported in the Lenovo H…7.8
• CVE-2020-8346A denial of service vulnerability was reported in the Lenovo…5.5