CVE-2023-3113 - OpenCVE

An unauthenticated XML external entity injection (XXE) vulnerability exists in LXCA's Common Information Model (CIM) server that could result in read-only access to specific files.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Lenovo	Xclarity Administrator

Configuration 1 [-]

cpe:2.3:a:lenovo:xclarity_administrator:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://support.lenovo.com/us/en/product_security/LEN-98715

History

No history.

MITRE

Status: PUBLISHED

Assigner: lenovo

Published: 2023-06-26T19:44:58.093Z

Updated: 2024-08-02T06:48:07.103Z

Reserved: 2023-06-05T19:17:02.529Z

Link: CVE-2023-3113

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2023-06-26T20:15:10.653

Modified: 2023-07-07T19:09:45.693

Link: CVE-2023-3113

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-3113", "assignerOrgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b", "state": "PUBLISHED", "assignerShortName": "lenovo", "dateReserved": "2023-06-05T19:17:02.529Z", "datePublished": "2023-06-26T19:44:58.093Z", "dateUpdated": "2024-08-02T06:48:07.103Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Lenovo XClarity Administrator", "vendor": "Lenovo", "versions": [{"status": "affected", "version": "Versions prior to 4.0"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "An unauthenticated XML external entity injection (XXE) vulnerability exists in LXCA's Common Information Model (CIM) server that could result in read-only access to specific files."}], "value": "An unauthenticated XML external entity injection (XXE) vulnerability exists in LXCA's Common Information Model (CIM) server that could result in read-only access to specific files."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-611", "description": "CWE-611 Improper Restriction of XML External Entity Reference", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b", "shortName": "lenovo", "dateUpdated": "2023-06-26T19:44:58.093Z"}, "references": [{"url": "https://support.lenovo.com/us/en/product_security/LEN-98715"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Update LXCA to version 4.0 or later."}], "value": "Update LXCA to version 4.0 or later."}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T06:48:07.103Z"}, "title": "CVE Program Container", "references": [{"url": "https://support.lenovo.com/us/en/product_security/LEN-98715", "tags": ["x_transferred"]}]}]}}