6.3

CVE-2023-2993

A valid, authenticated user with limited privileges may be able to use specifically crafted web management server API calls to execute a limited number of commands on SMM v1, SMM v2, and FPC that the user does not normally have sufficient privileges to execute.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Lenovo ≫ Nextscale N1200 Enclosure Firmware Version < fhet60b-3.40
   Lenovo ≫ Nextscale N1200 Enclosure Version -
Lenovo ≫ Thinkagile Cp-cb-10 Firmware Version < tesm38c-1.26
   Lenovo ≫ Thinkagile Cp-cb-10 Version -
Lenovo ≫ Thinkagile Cp-cb-10e Firmware Version < tesm38c-1.26
   Lenovo ≫ Thinkagile Cp-cb-10e Version -
Lenovo ≫ Thinkagile Vx Enclosure Firmware Version < tesm38c-1.26
   Lenovo ≫ Thinkagile Vx Enclosure Version -
Lenovo ≫ Thinksystem D2 Enclosure Firmware Version < tesm38c-1.26
   Lenovo ≫ Thinksystem D2 Enclosure Version -
Lenovo ≫ Thinksystem Da240 Enclosure Firmware Version < umsm10s-1.07
   Lenovo ≫ Thinksystem Da240 Enclosure Version -
Lenovo ≫ Thinksystem Dw612 Enclosure Firmware Version < umsm10s-1.07
   Lenovo ≫ Thinksystem Dw612 Enclosure Version -
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.29% 0.205
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 6.3 2.8 3.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Lenovo 5.4 2.8 2.5
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CWE-281 Improper Preservation of Permissions

The product does not preserve permissions or incorrectly preserves permissions when copying, restoring, or sharing objects, which can cause them to have less restrictive permissions than intended.

https://support.lenovo.com/us/en/product_security/LEN-127357
Vendor Advisory