Lucene search

LenovoVULNRICHMENT:CVE-2023-4606

HistoryOct 24, 2023 - 8:25 p.m.

CVE-2023-4606

2023-10-2420:25:09

CWE-862

lenovo

github.com

authenticated user

xcc

read-only permission

password change

api command

thinksystem

v2 servers

v3 servers

not affected

CVSS3

8.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

AI Score

6.9

Confidence

Low

EPSS

0.001

Percentile

21.9%

SSVC

Exploitation

none

Automatable

Technical Impact

partial

JSON

An authenticated XCC user with Read-Only permission can change a different user’s password through a crafted API command.

This affects ThinkSystem v2 and v3 servers with XCC; ThinkSystem v1 servers are not affected.

References

support.lenovo.com/us/en/product_security/LEN-140960

CVSS3

8.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

AI Score

6.9

Confidence

Low

EPSS

0.001

Percentile

21.9%

SSVC

Exploitation

none

Automatable

Technical Impact

partial

JSON

Related for VULNRICHMENT:CVE-2023-4606