Medium WID-SEC-2023-1454 5 CVEs

Lenovo XClarity Administrator: Mehrere Schwachstellen

Published Jun 13, 2023 · Updated Jun 13, 2023 · de-DE

Vendor: Lenovo Product: XClarity Administrator < 4.0 Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen im Lenovo XClarity Administrator ausnutzen, um Informationen offenzulegen, Daten zu manipulieren, oder Code auszuführen.

Product

Lenovo XClarity ist ein Verwaltungswerkzeug für Rechenzentren.

Vulnerabilities 5

High 8.2

CVE-2023-3113

An unauthenticated XML external entity injection (XXE) vulnerability exists in LXCA's Common Information Model (CIM) se…

Lenovo Lenovo XClarity Administrator

Jun 26, 2023
High 8.1

CVE-2023-34418

A valid, authenticated LXCA user may be able to gain unauthorized access to events and other data stored in LXCA due to…

Lenovo Lenovo XClarity Administrator

Jun 26, 2023
High 7.2

CVE-2023-34420

A valid, authenticated LXCA user with elevated privileges may be able to execute command injections through crafted cal…

Lenovo Lenovo XClarity Administrator

Jun 26, 2023
Medium 6.5

CVE-2023-34421

A valid, authenticated LXCA user with elevated privileges may be able to replace filesystem data through a specifically…

Lenovo Lenovo XClarity Administrator

Jun 26, 2023
Medium 6.5

CVE-2023-34422

A valid, authenticated LXCA user with elevated privileges may be able to delete folders in the LXCA filesystem through …

Lenovo Lenovo XClarity Administrator

Jun 26, 2023

Revision history

2023-06-13 #1
Initiale Fassung

References

Lenovo Security Advisory vom 2023-06-13
https://support.lenovo.com/us/en/product_security/ps500564-lenovo-xclarity-administrator-lxca-vulnerabilities