medium5.3
CVE-2023-29056
A valid LDAP user, under specific conditions, will default to read-only permissions when authenticating into XCC.
Impact
A valid LDAP user, under specific conditions, will default to read-only permissions when authenticating into XCC. To be vulnerable, XCC must be configured to use an LDAP server for Authentication/Authorization and have the login permission attribute not defined.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Lenovo | Thinkagile Hx5530 Firmware | before 2.93_afbt30p |
| Lenovo | Thinkagile Hx7530 Firmware | before 2.93_afbt30p |
| Lenovo | Thinkagile Vx3331 Firmware | before 2.93_afbt30p |
| Lenovo | Thinkagile Hx Enclosure Firmware | before 3.72_tei388s |
| Lenovo | Thinkagile Hx1021 Firmware | before 3.72_tei388s |
| Lenovo | Thinkagile Hx1320 Firmware | before 8.88_cdi3a4a |
| Lenovo | Thinkagile Hx1321 Firmware | before 8.88_cdi3a4a |
| Lenovo | Thinkagile Hx1331 Firmware | before 2.93_afbt30p |
| Lenovo | Thinkagile Hx1520-R Firmware | before 8.88_cdi3a4a |
| Lenovo | Thinkagile Hx1521-R Firmware | before 8.88_cdi3a4a |
| Lenovo | Thinkagile Hx2320-E Firmware | before 8.88_cdi3a4a |
| Lenovo | Thinkagile Hx2321 Firmware | before 8.88_cdi3a4a |