Skip to content
OpenAdvisories
High · 8.1 CVE-2023-4606 EUVD-2023-54459GHSA-fm9p-5c8h-mw8h

An authenticated XCC user with Read-Only permission can change a different user’s password through a crafted API command.   This affects Th…

Published Oct 24, 2023 · Updated Sep 11, 2024 · Assigned by lenovo

Vendor: Lenovo Product: Lenovo XClarity Controller (XCC)

Description

An authenticated XCC user with Read-Only permission can change a different user’s password through a crafted API command.  

This affects ThinkSystem v2 and v3 servers with XCC; ThinkSystem v1 servers are not affected.

Affected products

VendorProductAffectedFixed
Lenovo Lenovo XClarity Controller (XCC) various —

Advisories 1

References