high8.3
CVE-2023-0683
A valid, authenticated XCC user with read only access may gain elevated privileges through a specifically crafted API call.
Impact
A valid, authenticated XCC user with read only access may gain elevated privileges through a specifically crafted API call.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Lenovo | Thinkagile Hx5530 Firmware | before 2.93_afbt30p |
| Lenovo | Thinkagile Hx7530 Firmware | before 2.93_afbt30p |
| Lenovo | Thinkagile Vx3331 Firmware | before 2.93_afbt30p |
| Lenovo | Thinkagile Hx Enclosure Firmware | before 3.72_tei388s |
| Lenovo | Thinkagile Hx1021 Firmware | before 3.72_tei388s |
| Lenovo | Thinkagile Hx1320 Firmware | before 8.88_cdi3a4a |
| Lenovo | Thinkagile Hx1321 Firmware | before 8.88_cdi3a4a |
| Lenovo | Thinkagile Hx1331 Firmware | before 2.93_afbt30p |
| Lenovo | Thinkagile Hx1520-R Firmware | before 8.88_cdi3a4a |
| Lenovo | Thinkagile Hx1521-R Firmware | before 8.88_cdi3a4a |
| Lenovo | Thinkagile Hx2320-E Firmware | before 8.88_cdi3a4a |
| Lenovo | Thinkagile Hx2321 Firmware | before 8.88_cdi3a4a |