XCC Privilege Escalation in Lenovo Products Due to API Misconfiguration
CVE-2023-0683

8.3HIGH

Key Information:

Vendor
Lenovo
Status
Xclarity Controller
Vendor
CVE Published:
1 May 2023

Summary

An authenticated user with read-only access to Lenovo's Extreme Control Center (XCC) may exploit a vulnerability that allows them to elevate their privileges via a maliciously crafted API call. This could lead to unauthorized access to sensitive system functions, compromising the security of the affected environment. Organizations using XCC should assess their exposure and implement necessary mitigations.

Affected Version(s)

XClarity Controller See product security advisory below

References

https://support.lenovo.com/us/en/product_security/LEN-99936

CVSS V3.1

Score:
8.3
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.