8.1

CVE-2023-4606

An authenticated XCC user with Read-Only permission can change a different user’s password through a crafted API command.  

This affects ThinkSystem v2 and v3 servers with XCC; ThinkSystem v1 servers are not affected.

Data is provided by the National Vulnerability Database (NVD)
Lenovo ≫ Thinkagile Hx5530 Firmware Version-
   Lenovo ≫ Thinkagile Hx5530 Version-
Lenovo ≫ Thinkagile Hx7530 Firmware Version-
   Lenovo ≫ Thinkagile Hx7530 Version-
Lenovo ≫ Thinkagile Vx3331 Firmware Version-
   Lenovo ≫ Thinkagile Vx3331 Version-
Lenovo ≫ Thinkagile Hx1331 Firmware Version-
   Lenovo ≫ Thinkagile Hx1331 Version-
Lenovo ≫ Thinkagile Hx2330 Firmware Version-
   Lenovo ≫ Thinkagile Hx2330 Version-
Lenovo ≫ Thinkagile Hx2331 Firmware Version-
   Lenovo ≫ Thinkagile Hx2331 Version-
Lenovo ≫ Thinkagile Hx3330 Firmware Version-
   Lenovo ≫ Thinkagile Hx3330 Version-
Lenovo ≫ Thinkagile Hx3331 Firmware Version-
   Lenovo ≫ Thinkagile Hx3331 Version-
Lenovo ≫ Thinkagile Hx3331 Firmware Version-
   Lenovo ≫ Thinkagile Hx3331 Version-
Lenovo ≫ Thinkagile Hx3375 Firmware Version-
   Lenovo ≫ Thinkagile Hx3375 Version-
Lenovo ≫ Thinkagile Hx3376 Firmware Version-
   Lenovo ≫ Thinkagile Hx3376 Version-
Lenovo ≫ Thinkagile Hx5531 Firmware Version-
   Lenovo ≫ Thinkagile Hx5531 Version-
Lenovo ≫ Thinkagile Hx7530 Firmware Version-
   Lenovo ≫ Thinkagile Hx7530 Version-
Lenovo ≫ Thinkagile Hx7531 Firmware Version-
   Lenovo ≫ Thinkagile Hx7531 Version-
Lenovo ≫ Thinkagile Hx7531 Firmware Version-
   Lenovo ≫ Thinkagile Hx7531 Version-
Lenovo ≫ Thinkagile Vx2330 Firmware Version-
   Lenovo ≫ Thinkagile Vx2330 Version-
Lenovo ≫ Thinkagile Vx3330 Firmware Version-
   Lenovo ≫ Thinkagile Vx3330 Version-
Lenovo ≫ Thinkagile Vx5530 Firmware Version-
   Lenovo ≫ Thinkagile Vx5530 Version-
Lenovo ≫ Thinkagile Vx7330 Firmware Version-
   Lenovo ≫ Thinkagile Vx7330 Version-
Lenovo ≫ Thinkagile Vx7530 Firmware Version-
   Lenovo ≫ Thinkagile Vx7530 Version-
Lenovo ≫ Thinkagile Vx7531 Firmware Version-
   Lenovo ≫ Thinkagile Vx7531 Version-
Lenovo ≫ Thinksystem Sr645 Firmware Version-
   Lenovo ≫ Thinksystem Sr645 Version-
Lenovo ≫ Thinksystem Sr665 Firmware Version-
   Lenovo ≫ Thinksystem Sr665 Version-
Lenovo ≫ Thinksystem Sr670 Firmware Version-
   Lenovo ≫ Thinksystem Sr670 Version-
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.12% 0.317
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 8.1 2.8 5.2
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
psirt@lenovo.com 8.1 2.8 5.2
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
CWE-862 Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.