8.1

CVE-2023-4606

An authenticated XCC user with Read-Only permission can change a different user’s password through a crafted API command.  

This affects ThinkSystem v2 and v3 servers with XCC; ThinkSystem v1 servers are not affected.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Lenovo ≫ Thinkagile Hx5530 Firmware Version -
   Lenovo ≫ Thinkagile Hx5530 Version -
Lenovo ≫ Thinkagile Hx7530 Firmware Version -
   Lenovo ≫ Thinkagile Hx7530 Version -
Lenovo ≫ Thinkagile Vx3331 Firmware Version -
   Lenovo ≫ Thinkagile Vx3331 Version -
Lenovo ≫ Thinkagile Hx1331 Firmware Version -
   Lenovo ≫ Thinkagile Hx1331 Version -
Lenovo ≫ Thinkagile Hx2330 Firmware Version -
   Lenovo ≫ Thinkagile Hx2330 Version -
Lenovo ≫ Thinkagile Hx2331 Firmware Version -
   Lenovo ≫ Thinkagile Hx2331 Version -
Lenovo ≫ Thinkagile Hx3330 Firmware Version -
   Lenovo ≫ Thinkagile Hx3330 Version -
Lenovo ≫ Thinkagile Hx3331 Firmware Version -
   Lenovo ≫ Thinkagile Hx3331 Version -
Lenovo ≫ Thinkagile Hx3331 Firmware Version -
   Lenovo ≫ Thinkagile Hx3331 Version -
Lenovo ≫ Thinkagile Hx3375 Firmware Version -
   Lenovo ≫ Thinkagile Hx3375 Version -
Lenovo ≫ Thinkagile Hx3376 Firmware Version -
   Lenovo ≫ Thinkagile Hx3376 Version -
Lenovo ≫ Thinkagile Hx5531 Firmware Version -
   Lenovo ≫ Thinkagile Hx5531 Version -
Lenovo ≫ Thinkagile Hx7530 Firmware Version -
   Lenovo ≫ Thinkagile Hx7530 Version -
Lenovo ≫ Thinkagile Hx7531 Firmware Version -
   Lenovo ≫ Thinkagile Hx7531 Version -
Lenovo ≫ Thinkagile Hx7531 Firmware Version -
   Lenovo ≫ Thinkagile Hx7531 Version -
Lenovo ≫ Thinkagile Vx2330 Firmware Version -
   Lenovo ≫ Thinkagile Vx2330 Version -
Lenovo ≫ Thinkagile Vx3330 Firmware Version -
   Lenovo ≫ Thinkagile Vx3330 Version -
Lenovo ≫ Thinkagile Vx5530 Firmware Version -
   Lenovo ≫ Thinkagile Vx5530 Version -
Lenovo ≫ Thinkagile Vx7330 Firmware Version -
   Lenovo ≫ Thinkagile Vx7330 Version -
Lenovo ≫ Thinkagile Vx7530 Firmware Version -
   Lenovo ≫ Thinkagile Vx7530 Version -
Lenovo ≫ Thinkagile Vx7531 Firmware Version -
   Lenovo ≫ Thinkagile Vx7531 Version -
Lenovo ≫ Thinksystem Sr250 Firmware Version -
   Lenovo ≫ Thinksystem Sr250 V2 Version -
Lenovo ≫ Thinksystem Sr645 Firmware Version -
   Lenovo ≫ Thinksystem Sr645 Version -
Lenovo ≫ Thinksystem Sr665 Firmware Version -
   Lenovo ≫ Thinksystem Sr665 Version -
Lenovo ≫ Thinksystem Sr670 Firmware Version -
   Lenovo ≫ Thinksystem Sr670 Version -
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.46% 0.362
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 8.1 2.8 5.2
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Lenovo 8.1 2.8 5.2
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
CWE-862 Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

https://support.lenovo.com/us/en/product_security/LEN-140960
Vendor Advisory