Medium · 4.1 CVE-2023-4608 EUVD-2023-54461GHSA-96gf-qq25-2c24

An authenticated XCC user with elevated privileges can perform blind SQL injection in limited cases through a crafted API command. This af…

Published Oct 24, 2023 · Updated Sep 11, 2024 · Assigned by lenovo

Description

An authenticated XCC user with elevated privileges can perform blind SQL injection in limited cases through a crafted API command.

This affects ThinkSystem v2 and v3 servers with XCC; ThinkSystem v1 servers are not affected.

Vendor	Product	Affected	Fixed
Lenovo	Lenovo XClarity Controller (XCC)	various	—