Lucene search

LenovoCVE-2023-34422

HistoryJun 26, 2023 - 8:15 p.m.

CVE-2023-34422

2023-06-2620:15:10

CWE-20

lenovo

web.nvd.nist.gov

cve-2023-34422

lxca

authenticated user

web api

input validation

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

AI Score

6.2

Confidence

High

EPSS

0.001

Percentile

33.0%

JSON

A valid, authenticated LXCA user with elevated privileges may be able to delete folders in the LXCA filesystem through a specifically crafted web API call due to insufficient input validation.

Affected configurations

Nvd

Node

lenovoxclarity_administratorRange<4.0.0

VendorProductVersionCPE
lenovoxclarity_administrator*cpe:2.3:a:lenovo:xclarity_administrator:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
lenovo	xclarity_administrator	*	cpe:2.3:a:lenovo:xclarity_administrator::::::::

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Lenovo XClarity Administrator",
    "vendor": "Lenovo",
    "versions": [
      {
        "status": "affected",
        "version": "Versions prior to 4.0"
      }
    ]
  }
]

References

support.lenovo.com/us/en/product_security/LEN-98715

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

AI Score

6.2

Confidence

High

EPSS

0.001

Percentile

33.0%

JSON

Related for CVE-2023-34422