Lucene search

[email protected]CVE-2023-4608

HistoryOct 25, 2023 - 6:17 p.m.

CVE-2023-4608

2023-10-2518:17:41

CWE-89

[email protected]

web.nvd.nist.gov

cve-2023-4608

authenticated user

xcc

elevated privileges

sql injection

api command

thinksystem v2

thinksystem v3

nvd

7.2 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

7.3 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

19.4%

JSON

An authenticated XCC user with elevated privileges can perform blind SQL injection in limited cases through a crafted API command.

This affects ThinkSystem v2 and v3 servers with XCC; ThinkSystem v1 servers are not affected.

Affected configurations

NVD

Node

lenovothinkagile_hx5530_firmwareMatch-

AND

lenovothinkagile_hx5530Match-

Node

lenovothinkagile_hx7530_firmwareMatch-

AND

lenovothinkagile_hx7530Match-

Node

lenovothinkagile_vx3331_firmwareMatch-

AND

lenovothinkagile_vx3331Match-

Node

lenovothinkagile_hx1331_firmwareMatch-

AND

lenovothinkagile_hx1331Match-

Node

lenovothinkagile_hx2330_firmwareMatch-

AND

lenovothinkagile_hx2330Match-

Node

lenovothinkagile_hx2331_firmwareMatch-

AND

lenovothinkagile_hx2331Match-

Node

lenovothinkagile_hx3330_firmwareMatch-

AND

lenovothinkagile_hx3330Match-

Node

lenovothinkagile_hx3331_firmwareMatch-

AND

lenovothinkagile_hx3331Match-

Node

lenovothinkagile_hx3331_firmwareMatch-

AND

lenovothinkagile_hx3331Match-

Node

lenovothinkagile_hx3375_firmwareMatch-

AND

lenovothinkagile_hx3375Match-

Node

lenovothinkagile_hx3376_firmwareMatch-

AND

lenovothinkagile_hx3376Match-

Node

lenovothinkagile_hx5531_firmwareMatch-

AND

lenovothinkagile_hx5531Match-

Node

lenovothinkagile_hx7530_firmwareMatch-

AND

lenovothinkagile_hx7530Match-

Node

lenovothinkagile_hx7531_firmwareMatch-

AND

lenovothinkagile_hx7531Match-

Node

lenovothinkagile_hx7531_firmwareMatch-

AND

lenovothinkagile_hx7531Match-

Node

lenovothinkagile_mx3330-f_all-flash_firmwareMatch-

AND

lenovothinkagile_mx3330-f_all-flashMatch-

Node

lenovothinkagile_mx3330-h_hybrid_firmwareMatch-

AND

lenovothinkagile_mx3330-h_hybridMatch-

Node

lenovothinkagile_mx3331-f_all-flash_firmwareMatch-

AND

lenovothinkagile_mx3331-f_all-flashMatch-

Node

lenovothinkagile_mx3331-h_hybrid_firmwareMatch-

AND

lenovothinkagile_mx3331-h_hybridMatch-

Node

lenovothinkagile_mx3530_f_all_flash_firmwareMatch-

AND

lenovothinkagile_mx3530_f_all_flashMatch-

Node

lenovothinkagile_mx3530-h_hybrid_firmwareMatch-

AND

lenovothinkagile_mx3530-h_hybridMatch-

Node

lenovothinkagile_mx3531_h_hybrid_firmwareMatch-

AND

lenovothinkagile_mx3531_h_hybridMatch-

Node

lenovothinkagile_mx3531-f_all-flash_firmwareMatch-

AND

lenovothinkagile_mx3531-f_all-flashMatch-

Node

lenovothinkagile_vx2330_firmwareMatch-

AND

lenovothinkagile_vx2330Match-

Node

lenovothinkagile_vx3330_firmwareMatch-

AND

lenovothinkagile_vx3330Match-

Node

lenovothinkagile_vx3530-g_firmwareMatch-

AND

lenovothinkagile_vx3530-gMatch-

Node

lenovothinkagile_vx5530_firmwareMatch-

AND

lenovothinkagile_vx5530Match-

Node

lenovothinkagile_vx7330_firmwareMatch-

AND

lenovothinkagile_vx7330Match-

Node

lenovothinkagile_vx7530_firmwareMatch-

AND

lenovothinkagile_vx7530Match-

Node

lenovothinkagile_vx7531_firmwareMatch-

AND

lenovothinkagile_vx7531Match-

Node

lenovothinksystem_sd630_v2_firmwareMatch-

AND

lenovothinksystem_sd630_v2Match-

Node

lenovothinksystem_sd650_v2_firmwareMatch-

AND

lenovothinksystem_sd650_v2Match-

Node

lenovothinksystem_sd650_v3_firmwareMatch-

Node

lenovothinksystem_sd650-n_v2_firmwareMatch-

AND

lenovothinksystem_sd650-n_v2Match-

Node

lenovothinksystem_sd665_v3_firmwareMatch-

Node

lenovothinksystem_sn550_v2_firmwareMatch-

AND

lenovothinksystem_sn550_v2Match-

Node

lenovothinksystem_sr250_firmwareMatch-

AND

lenovothinksystem_sr250_v2Match-

Node

lenovothinksystem_sr258_v2_firmwareMatch-

AND

lenovothinksystem_sr258_v2Match-

Node

lenovothinksystem_sr630_v2_firmwareMatch-

AND

lenovothinksystem_sr630_v2Match-

Node

lenovothinksystem_sr630_v3_firmwareMatch-

Node

lenovothinksystem_sr635_v3_firmwareMatch-

Node

lenovothinksystem_sr645_firmwareMatch-

AND

lenovothinksystem_sr645Match-

Node

lenovothinksystem_sr645_v3_firmwareMatch-

AND

lenovothinksystem_sr645_v3Match-

Node

lenovothinksystem_sr650_v2_firmwareMatch-

AND

lenovothinksystem_sr650_v2Match-

Node

lenovothinksystem_sr650_v3_firmwareMatch-

Node

lenovothinksystem_sr655_v3_firmwareMatch-

Node

lenovothinksystem_sr665_firmwareMatch-

AND

lenovothinksystem_sr665Match-

Node

lenovothinksystem_sr665_v3_firmwareMatch-

Node

lenovothinksystem_sr670_firmwareMatch-

AND

lenovothinksystem_sr670Match-

Node

lenovothinksystem_sr670_v2_firmwareMatch-

AND

lenovothinksystem_sr670_v2Match-

Node

lenovothinksystem_sr675_v3_firmwareMatch-

Node

lenovothinksystem_sr850_v2_firmwareMatch-

AND

lenovothinksystem_sr850_v2Match-

Node

lenovothinksystem_sr850_v2_firmwareMatch-

AND

lenovothinksystem_sr850_v2Match-

Node

lenovothinksystem_sr850_v3_firmwareMatch-

Node

lenovothinksystem_sr860_v2_firmwareMatch-

AND

lenovothinksystem_sr860_v2Match-

Node

lenovothinksystem_sr860_v2_firmwareMatch-

AND

lenovothinksystem_sr860_v2Match-

Node

lenovothinksystem_sr860_v3_firmwareMatch-

Node

lenovothinksystem_st250_v2_firmwareMatch-

AND

lenovothinksystem_st250_v2Match-

Node

lenovothinksystem_st258_v2_firmwareMatch-

AND

lenovothinksystem_st258_v2Match-

Node

lenovothinksystem_st650_v2_firmwareMatch-

AND

lenovothinksystem_st650_v2Match-

Node

lenovothinksystem_st650_v3_firmwareMatch-

Node

lenovothinksystem_st658_v2_firmwareMatch-

AND

lenovothinksystem_st658_v2Match-

Node

lenovothinksystem_st658_v3_firmwareMatch-

CPENameOperatorVersion
lenovo:thinkagile_hx5530_firmwarelenovo thinkagile hx5530 firmwareeq-

CPE	Name	Operator	Version
lenovo:thinkagile_hx5530_firmware	lenovo thinkagile hx5530 firmware	eq	-

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Lenovo XClarity Controller (XCC)",
    "vendor": "Lenovo",
    "versions": [
      {
        "status": "affected",
        "version": "various"
      }
    ]
  }
]

References

support.lenovo.com/us/en/product_security/LEN-140960

7.2 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

7.3 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

19.4%

JSON

Related for CVE-2023-4608

cvelist1 nvd1 prion1