170 matches found
Design/Logic Flaw
A valid, authenticated administrative user can query a web interface API to reveal the configured LDAP client password used by XCC to authenticate to an external LDAP server in certain configurations. There is no exposure where no LDAP client password is configured...
CVE-2023-25495
Summary: CVE-2023-25495 affects Lenovo XClarity Controller (XCC). A valid, authenticated administrative user can query the web interface API to reveal the LDAP client password used by XCC to authenticate to an external LDAP server in certain configurations. There is no exposure where no LDAP clie...
CVE-2023-29058
A valid, authenticated XCC user with read-only permissions can modify custom user roles on other user accounts and the user trespass message through the XCC CLI. There is no exposure if SSH is disabled or if there are no users assigned optional read-only permissions...
CVE-2023-29057
A valid XCC user's local account permissions overrides their active directory permissions under specific configurations. This could lead to a privilege escalation. To be vulnerable, LDAP must be configured for authentication/authorization and logins configured as “Local First, then LDAP”...
CVE-2023-29058
A valid, authenticated XCC user with read-only permissions can modify custom user roles on other user accounts and the user trespass message through the XCC CLI. There is no exposure if SSH is disabled or if there are no users assigned optional read-only permissions...
Code injection
A valid, authenticated XCC user with read-only permissions can modify custom user roles on other user accounts and the user trespass message through the XCC CLI. There is no exposure if SSH is disabled or if there are no users assigned optional read-only permissions...
CVE-2023-29056
A valid LDAP user, under specific conditions, will default to read-only permissions when authenticating into XCC. To be vulnerable, XCC must be configured to use an LDAP server for Authentication/Authorization and have the login permission attribute not defined...
CVE-2023-29056
A valid LDAP user, under specific conditions, will default to read-only permissions when authenticating into XCC. To be vulnerable, XCC must be configured to use an LDAP server for Authentication/Authorization and have the login permission attribute not defined...
CVE-2023-29056
CVE-2023-29056 affects Lenovo XClarity Controller (XCC). Under specific conditions, a valid LDAP user will default to read-only permissions during authentication if XCC is configured to use an LDAP server for Authentication/Authorization and the login permission attribute is not defined. Multiple...
CVE-2023-29057
CVE-2023-29057 affects Lenovo XClarity Controller (XCC). A valid XCC user’s local account permissions can override their Active Directory permissions under specific LDAP configurations labeled as “Local First, then LDAP,” enabling privilege escalation. Documented impact includes high confidential...
CVE-2023-29057
A valid XCC user's local account permissions overrides their active directory permissions under specific configurations. This could lead to a privilege escalation. To be vulnerable, LDAP must be configured for authentication/authorization and logins configured as “Local First, then LDAP”...
CVE-2023-29058
A valid, authenticated XCC user with read-only permissions can modify custom user roles on other user accounts and the user trespass message through the XCC CLI. There is no exposure if SSH is disabled or if there are no users assigned optional read-only permissions...
CVE-2023-29058
CVE-2023-29058 concerns Lenovo XClarity Controller (XCC). A valid, authenticated XCC user with read-only permissions can modify custom user roles on other user accounts and alter the user trespass message via the XCC CLI. The impact is described as enabling unintended modifications to user roles ...
CVE-2023-29058
A valid, authenticated XCC user with read-only permissions can modify custom user roles on other user accounts and the user trespass message through the XCC CLI. There is no exposure if SSH is disabled or if there are no users assigned optional read-only permissions...
CVE-2023-25495: Insufficiently Protected Credentials
A valid, authenticated administrative user can query a web interface API to reveal the configured LDAP client password used by XCC to authenticate to an external LDAP server in certain configurations. There is no exposure where no LDAP client password is configured...
CVE-2023-29058: Incorrect Default Permissions
A valid, authenticated XCC user with read-only permissions can modify custom user roles on other user accounts and the user trespass message through the XCC CLI. There is no exposure if SSH is disabled or if there are no users assigned optional read-only permissions...
CVE-2023-29057: Incorrect Default Permissions
A valid XCC user's local account permissions overrides their active directory permissions under specific configurations. This could lead to a privilege escalation. To be vulnerable, LDAP must be configured for authentication/authorization and logins configured as “Local First, then LDAP”...
PT-2023-22114
Name of the Vulnerable Software and Affected Versions XCC affected versions not specified Description A valid LDAP user, under specific conditions, will default to read-only permissions when authenticating into XCC. To be vulnerable, XCC must be configured to use an LDAP server for...
CVE-2023-29056: Improper Privilege Management
A valid LDAP user, under specific conditions, will default to read-only permissions when authenticating into XCC. To be vulnerable, XCC must be configured to use an LDAP server for Authentication/Authorization and have the login permission attribute not defined...
Authentication flaw
A read-only authentication bypass vulnerability was reported in the Third Quarter 2021 release of Lenovo XClarity Controller XCC firmware affecting XCC devices configured in LDAP Authentication Only Mode and using an LDAP server that supports “unauthenticated bind”, such as Microsoft Active...