Description
A valid XCC user's local account permissions overrides their active directory permissions under specific configurations. This could lead to a privilege escalation. To be vulnerable, LDAP must be configured for authentication/authorization and logins configured as “Local First, then LDAP”.
Published: 2023-04-28
Score: 7.3 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

No analysis available yet.

Remediation

Vendor Solution

Customers should update to the version (or later) of Lenovo XClarity Controller (XCC) identified in the related Lenovo Product Security Advisory:  https://support.lenovo.com/us/en/product_security/LEN-118321 https://support.lenovo.com/us/en/product_security/LEN-118321

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2023-32660 A valid XCC user's local account permissions overrides their active directory permissions under specific configurations. This could lead to a privilege escalation. To be vulnerable, LDAP must be configured for authentication/authorization and logins configured as “Local First, then LDAP”.
History

Thu, 30 Jan 2025 19:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}


Subscriptions

Lenovo Thinkagile Hx1021 Thinkagile Hx1021 Firmware Thinkagile Hx1320 Thinkagile Hx1320 Firmware Thinkagile Hx1321 Thinkagile Hx1321 Firmware Thinkagile Hx1331 Thinkagile Hx1331 Firmware Thinkagile Hx1520-r Thinkagile Hx1520-r Firmware Thinkagile Hx1521-r Thinkagile Hx1521-r Firmware Thinkagile Hx2320-e Thinkagile Hx2320-e Firmware Thinkagile Hx2321 Thinkagile Hx2321 Firmware Thinkagile Hx2330 Thinkagile Hx2330 Firmware Thinkagile Hx2331 Thinkagile Hx2331 Firmware Thinkagile Hx2720-e Thinkagile Hx2720-e Firmware Thinkagile Hx3320 Thinkagile Hx3320 Firmware Thinkagile Hx3321 Thinkagile Hx3321 Firmware Thinkagile Hx3330 Thinkagile Hx3330 Firmware Thinkagile Hx3331 Thinkagile Hx3331 Firmware Thinkagile Hx3375 Thinkagile Hx3375 Firmware Thinkagile Hx3376 Thinkagile Hx3376 Firmware Thinkagile Hx3520-g Thinkagile Hx3520-g Firmware Thinkagile Hx3521-g Thinkagile Hx3521-g Firmware Thinkagile Hx3720 Thinkagile Hx3720 Firmware Thinkagile Hx3721 Thinkagile Hx3721 Firmware Thinkagile Hx5520 Thinkagile Hx5520-c Thinkagile Hx5520-c Firmware Thinkagile Hx5520 Firmware Thinkagile Hx5521 Thinkagile Hx5521-c Thinkagile Hx5521-c Firmware Thinkagile Hx5521 Firmware Thinkagile Hx5530 Thinkagile Hx5530 Firmware Thinkagile Hx5531 Thinkagile Hx5531 Firmware Thinkagile Hx7520 Thinkagile Hx7520 Firmware Thinkagile Hx7521 Thinkagile Hx7521 Firmware Thinkagile Hx7530 Thinkagile Hx7530 Firmware Thinkagile Hx7531 Thinkagile Hx7531 Firmware Thinkagile Hx7820 Thinkagile Hx7820 Firmware Thinkagile Hx7821 Thinkagile Hx7821 Firmware Thinkagile Hx Enclosure Thinkagile Hx Enclosure Firmware Thinkagile Mx1020 Thinkagile Mx1020 Firmware Thinkagile Mx1021 On Se350 Thinkagile Mx1021 On Se350 Firmware Thinkagile Mx3330-f Thinkagile Mx3330-f Firmware Thinkagile Mx3330-h Thinkagile Mx3330-h Firmware Thinkagile Mx3331-f Thinkagile Mx3331-f Firmware Thinkagile Mx3331-h Thinkagile Mx3331-h Firmware Thinkagile Mx3530-h Thinkagile Mx3530-h Firmware Thinkagile Mx3530 F Thinkagile Mx3530 F Firmware Thinkagile Mx3531-f Thinkagile Mx3531-f Firmware Thinkagile Mx3531 H Thinkagile Mx3531 H Firmware Thinkagile Vx1320 Thinkagile Vx1320 Firmware Thinkagile Vx2320 Thinkagile Vx2320 Firmware Thinkagile Vx2330 Thinkagile Vx2330 Firmware Thinkagile Vx3320 Thinkagile Vx3320 Firmware Thinkagile Vx3330 Thinkagile Vx3330 Firmware Thinkagile Vx3331 Thinkagile Vx3331 Firmware Thinkagile Vx3520-g Thinkagile Vx3520-g Firmware Thinkagile Vx3530-g Thinkagile Vx3530-g Firmware Thinkagile Vx3720 Thinkagile Vx3720 Firmware Thinkagile Vx5520 Thinkagile Vx5520 Firmware Thinkagile Vx5530 Thinkagile Vx5530 Firmware Thinkagile Vx7320 N Thinkagile Vx7320 N Firmware Thinkagile Vx7330 Thinkagile Vx7330 Firmware Thinkagile Vx7520 Thinkagile Vx7520 Firmware Thinkagile Vx7520 N Thinkagile Vx7520 N Firmware Thinkagile Vx7530 Thinkagile Vx7530 Firmware Thinkagile Vx7531 Thinkagile Vx7531 Firmware Thinkagile Vx7820 Thinkagile Vx7820 Firmware Thinkagile Vx 1se Thinkagile Vx 1se Firmware Thinkagile Vx 2u4n Thinkagile Vx 2u4n Firmware Thinkagile Vx 4u Thinkagile Vx 4u Firmware Thinkedge Se450 Thinkedge Se450 Firmware Thinkstation P920 Thinkstation P920 Firmware Thinksystem Sd530 Thinksystem Sd530 Firmware Thinksystem Sd630 V2 Thinksystem Sd630 V2 Firmware Thinksystem Sd650 Thinksystem Sd650-n V2 Thinksystem Sd650-n V2 Firmware Thinksystem Sd650 Firmware Thinksystem Sd650 V2 Thinksystem Sd650 V2 Firmware Thinksystem Se350 Thinksystem Se350 Firmware Thinksystem Sn550 Thinksystem Sn550 Firmware Thinksystem Sn550 V2 Thinksystem Sn550 V2 Firmware Thinksystem Sn850 Thinksystem Sn850 Firmware Thinksystem Sr150 Thinksystem Sr150 Firmware Thinksystem Sr158 Thinksystem Sr158 Firmware Thinksystem Sr250 Thinksystem Sr250 Firmware Thinksystem Sr250 V2 Thinksystem Sr250 V2 Firmware Thinksystem Sr258 Thinksystem Sr258 Firmware Thinksystem Sr258 V2 Thinksystem Sr258 V2 Firmware Thinksystem Sr530 Thinksystem Sr530 Firmware Thinksystem Sr550 Thinksystem Sr550 Firmware Thinksystem Sr570 Thinksystem Sr570 Firmware Thinksystem Sr590 Thinksystem Sr590 Firmware Thinksystem Sr630 Thinksystem Sr630 Firmware Thinksystem Sr630 V2 Thinksystem Sr630 V2 Firmware Thinksystem Sr645 Thinksystem Sr645 Firmware Thinksystem Sr645 V3 Thinksystem Sr645 V3 Firmware Thinksystem Sr650 Thinksystem Sr650 Firmware Thinksystem Sr650 V2 Thinksystem Sr650 V2 Firmware Thinksystem Sr665 Thinksystem Sr665 Firmware Thinksystem Sr665 V3 Thinksystem Sr665 V3 Firmware Thinksystem Sr670 Thinksystem Sr670 Firmware Thinksystem Sr670 V2 Thinksystem Sr670 V2 Firmware Thinksystem Sr850 Thinksystem Sr850 Firmware Thinksystem Sr850 V2 Thinksystem Sr850 V2 Firmware Thinksystem Sr850p Thinksystem Sr850p Firmware Thinksystem Sr860 Thinksystem Sr860 Firmware Thinksystem Sr860 V2 Thinksystem Sr860 V2 Firmware Thinksystem Sr950 Thinksystem Sr950 Firmware Thinksystem St250 Thinksystem St250 Firmware Thinksystem St250 V2 Thinksystem St250 V2 Firmware Thinksystem St258 Thinksystem St258 Firmware Thinksystem St258 V2 Thinksystem St258 V2 Firmware Thinksystem St550 Thinksystem St550 Firmware Thinksystem St650 V2 Thinksystem St650 V2 Firmware Thinksystem St658 V2 Thinksystem St658 V2 Firmware
cve-icon MITRE

Status: PUBLISHED

Assigner: lenovo

Published:

Updated: 2025-01-30T18:34:12.946Z

Reserved: 2023-03-30T12:46:45.646Z

Link: CVE-2023-29057

cve-icon Vulnrichment

Updated: 2024-08-02T14:00:15.127Z

cve-icon NVD

Status : Modified

Published: 2023-04-28T21:15:08.673

Modified: 2024-11-21T07:56:28.157

Link: CVE-2023-29057

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses