medium4.9
CVE-2023-25495
A valid, authenticated administrative user can query a web interface API to reveal the configured LDAP client password used by XCC to authenticate to an extern…
Impact
A valid, authenticated administrative user can query a web interface API to reveal the configured LDAP client password used by XCC to authenticate to an external LDAP server in certain configurations. There is no exposure where no LDAP client password is configured
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Lenovo | Thinkagile Hx5530 Firmware | before 2.93_afbt30p |
| Lenovo | Thinkagile Hx7530 Firmware | before 2.93_afbt30p |
| Lenovo | Thinkagile Vx3331 Firmware | before 2.93_afbt30p |
| Lenovo | Thinkagile Hx Enclosure Firmware | before 3.72_tei388s |
| Lenovo | Thinkagile Hx1021 Firmware | before 3.72_tei388s |
| Lenovo | Thinkagile Hx1320 Firmware | before 8.88_cdi3a4a |
| Lenovo | Thinkagile Hx1321 Firmware | before 8.88_cdi3a4a |
| Lenovo | Thinkagile Hx1331 Firmware | before 2.93_afbt30p |
| Lenovo | Thinkagile Hx1520-R Firmware | before 8.88_cdi3a4a |
| Lenovo | Thinkagile Hx1521-R Firmware | before 8.88_cdi3a4a |
| Lenovo | Thinkagile Hx2320-E Firmware | before 8.88_cdi3a4a |
| Lenovo | Thinkagile Hx2321 Firmware | before 8.88_cdi3a4a |