Description
A valid LDAP user, under specific conditions, will default to read-only permissions when authenticating into XCC. To be vulnerable, XCC must be configured to use an LDAP server for Authentication/Authorization and have the login permission attribute not defined.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Lenovo | XClarity Controller | Refer to Mitigation strategy section in LEN-118321 | — |
Advisories 1
- WID-SEC-2023-0928 Lenovo XClarity Controller: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 11, 2023