LDAP Client Password Exposure in XCC by Lenovo
CVE-2023-25495

4.9MEDIUM

Key Information:

Vendor

Lenovo
Status
Xclarity Controller
Vendor
CVE Published:
28 April 2023

What is CVE-2023-25495?

An identified vulnerability allows a valid, authenticated administrative user to exploit the web interface API of Lenovo XCC to disclose the configured LDAP client password used for establishing authentication with an external LDAP server. This issue is relevant only in configurations where an LDAP client password has been specifically set. The risk is mitigated in setups without a configured LDAP client password.

Affected Version(s)

XClarity Controller Refer to Mitigation strategy section in LEN-99936

References

https://support.lenovo.com/us/en/product_security/LEN-99936

CVSS V3.1

Score:
4.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.