An authenticated XCC user can change permissions for any user through a crafted API command
Published Oct 24, 2023
8.8
HIGHCVSS 3.1
EPSS 0.52%
Description
An authenticated XCC user can change permissions for any user through a crafted API command.
Affected products
-
- Version variousStatusaffectedConstraints-
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Lenovo | Lenovo XClarity Controller (XCC) | unaffected |
|
Configuration 1
- n/a
Running on/with
- n/a
Configuration 2
- n/a
Running on/with
- n/a
Configuration 3
- n/a
Running on/with
- n/a
Configuration 4
- n/a
Running on/with
- n/a
Configuration 5
- n/a
Running on/with
- n/a
Configuration 6
- n/a
Running on/with
- n/a
Configuration 7
- n/a
Running on/with
- n/a
Configuration 8
- n/a
Running on/with
- n/a
Configuration 9
- n/a
Running on/with
- n/a
Configuration 10
- n/a
Running on/with
- n/a
Configuration 11
- n/a
Running on/with
- n/a
Configuration 12
- n/a
Running on/with
- n/a
Configuration 13
- n/a
Running on/with
- n/a
Configuration 14
- n/a
Running on/with
- n/a
Configuration 15
- n/a
Running on/with
- n/a
Configuration 16
Running on/with
- n/a
Configuration 17
Running on/with
- n/a
Configuration 18
Running on/with
- n/a
Configuration 19
Running on/with
- n/a
Configuration 20
Running on/with
- n/a
Configuration 21
Running on/with
- n/a
Configuration 22
Running on/with
- n/a
Configuration 23
Running on/with
- n/a
Configuration 24
- n/a
Running on/with
- n/a
Configuration 25
- n/a
Running on/with
- n/a
Configuration 26
- n/a
Running on/with
- n/a
Configuration 27
- n/a
Running on/with
- n/a
Configuration 28
- n/a
Running on/with
- n/a
Configuration 29
- n/a
Running on/with
- n/a
Configuration 30
- n/a
Running on/with
- n/a
Configuration 31
- n/a
Running on/with
- n/a
Configuration 32
- n/a
Running on/with
- n/a
Configuration 33
- n/a
Configuration 34
- n/a
Running on/with
- n/a
Configuration 35
- n/a
Configuration 36
- n/a
Running on/with
- n/a
Configuration 37
- n/a
Running on/with
- n/a
Configuration 38
- n/a
Running on/with
- n/a
Configuration 39
- n/a
Running on/with
- n/a
Configuration 40
- n/a
Configuration 41
- n/a
Configuration 42
- n/a
Running on/with
- n/a
Configuration 43
- n/a
Running on/with
- n/a
Configuration 44
- n/a
Running on/with
- n/a
Configuration 45
- n/a
Configuration 46
- n/a
Configuration 47
- n/a
Running on/with
- n/a
Configuration 48
- n/a
Configuration 49
- n/a
Running on/with
- n/a
Configuration 50
- n/a
Running on/with
- n/a
Configuration 51
- n/a
Configuration 52
- n/a
Running on/with
- n/a
Configuration 53
- n/a
Running on/with
- n/a
Configuration 54
- n/a
Configuration 55
- n/a
Running on/with
- n/a
Configuration 56
- n/a
Running on/with
- n/a
Configuration 57
- n/a
Configuration 58
- n/a
Running on/with
- n/a
Configuration 59
- n/a
Running on/with
- n/a
Configuration 60
- n/a
Running on/with
- n/a
Configuration 61
- n/a
Configuration 62
- n/a
Running on/with
- n/a
Configuration 63
- n/a
Configuration 64
- n/a
Running on/with
- n/a
Configuration 65
- n/a
Running on/with
- n/a
Configuration 66
- n/a
Running on/with
- n/a
Configuration 67
- n/a
Running on/with
- n/a
Configuration 68
- n/a
Running on/with
- n/a
Configuration 69
- n/a
Running on/with
- n/a
Configuration 70
- n/a
Running on/with
- n/a
Configuration 71
- n/a
Running on/with
- n/a
Configuration 72
- n/a
Running on/with
- n/a
Configuration 73
- n/a
Running on/with
- n/a
Configuration 74
- n/a
Running on/with
- n/a
Configuration 75
- n/a
Running on/with
- n/a
Configuration 76
- n/a
Running on/with
- n/a
Configuration 77
- n/a
Running on/with
- n/a
Configuration 78
- n/a
Running on/with
- n/a
Configuration 79
- n/a
Running on/with
- n/a
Configuration 80
- n/a
Running on/with
- n/a
Configuration 81
- n/a
Running on/with
- n/a
Configuration 82
- n/a
Running on/with
- n/a
Configuration 83
- n/a
Running on/with
- n/a
Configuration 84
- n/a
Running on/with
- n/a
Configuration 85
- n/a
Running on/with
- n/a
Configuration 86
- n/a
Running on/with
- n/a
Configuration 87
Running on/with
- n/a
Configuration 88
- n/a
Configuration 89
- n/a
Configuration 90
- n/a
Configuration 91
- n/a
Configuration 92
Running on/with
- n/a
Configuration 93
Running on/with
- n/a
Configuration 94
- n/a
Running on/with
- n/a
Configuration 95
- n/a
Running on/with
- n/a
Configuration 96
- n/a
Running on/with
- n/a
Configuration 97
- n/a
Running on/with
- n/a
Configuration 98
- n/a
Running on/with
- n/a
Configuration 99
- n/a
Running on/with
- n/a
Configuration 100
- n/a
Running on/with
- n/a
Configuration 101
- n/a
Running on/with
- n/a
Configuration 102
- n/a
Running on/with
- n/a
Configuration 103
- n/a
Running on/with
- n/a
Configuration 104
- n/a
Running on/with
- n/a
Configuration 105
- n/a
Running on/with
- n/a
Configuration 106
- n/a
Running on/with
- n/a
Configuration 107
- n/a
Running on/with
- n/a
Configuration 108
- n/a
Running on/with
- n/a
Configuration 109
Running on/with
- n/a
Configuration 110
Running on/with
- n/a
Configuration 111
- n/a
Running on/with
- n/a
Configuration 112
- n/a
Running on/with
- n/a
Configuration 113
- n/a
Running on/with
- n/a
Configuration 114
- n/a
Running on/with
- n/a
Configuration 115
- n/a
Running on/with
- n/a
Configuration 116
- n/a
Running on/with
- n/a
Configuration 117
- n/a
Running on/with
- n/a
Configuration 118
- n/a
Running on/with
- n/a
Configuration 119
- n/a
Running on/with
- n/a
Configuration 120
- n/a
Running on/with
- n/a
Configuration 121
- n/a
Running on/with
- n/a
Configuration 122
- n/a
Running on/with
- n/a
Configuration 123
- n/a
Running on/with
- n/a
Configuration 124
- n/a
Running on/with
- n/a
Configuration 125
- n/a
Running on/with
- n/a
Configuration 126
- n/a
Running on/with
- n/a
Configuration 127
- n/a
Running on/with
- n/a
Configuration 128
- n/a
Running on/with
- n/a
Configuration 129
- n/a
Running on/with
- n/a
Configuration 130
- n/a
Running on/with
- n/a
Configuration 131
- n/a
Running on/with
- n/a
Configuration 132
- n/a
Running on/with
- n/a
Configuration 133
- n/a
Running on/with
- n/a
Configuration 134
- n/a
Running on/with
- n/a
Configuration 135
- n/a
Running on/with
- n/a
Configuration 136
- n/a
Running on/with
- n/a
No data.
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
Vendor solution
Upgrade to the product version (or newer) indicated for your model in the advisory: https://support.lenovo.com/us/en/product_security/LEN-140960
References (1)
- https://support.lenovo.com/us/en/product_security/LEN-140960 Vendor Advisory
| Link | Providers | Tags |
|---|---|---|
| https://support.lenovo.com/us/en/product_security/LEN-140960 | Vendor Advisory |
Change history (0)
No recorded changes yet.