high7.3
CVE-2023-29057
A valid XCC user's local account permissions overrides their active directory permissions under specific configurations.
Impact
A valid XCC user's local account permissions overrides their active directory permissions under specific configurations. This could lead to a privilege escalation. To be vulnerable, LDAP must be configured for authentication/authorization and logins configured as “Local First, then LDAP”.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Lenovo | Thinkagile Hx5530 Firmware | before 2.93_afbt30p |
| Lenovo | Thinkagile Hx7530 Firmware | before 2.93_afbt30p |
| Lenovo | Thinkagile Vx3331 Firmware | before 2.93_afbt30p |
| Lenovo | Thinkagile Hx Enclosure Firmware | before 3.72_tei388s |
| Lenovo | Thinkagile Hx1021 Firmware | before 3.72_tei388s |
| Lenovo | Thinkagile Hx1320 Firmware | before 8.88_cdi3a4a |
| Lenovo | Thinkagile Hx1321 Firmware | before 8.88_cdi3a4a |
| Lenovo | Thinkagile Hx1331 Firmware | before 2.93_afbt30p |
| Lenovo | Thinkagile Hx1520-R Firmware | before 8.88_cdi3a4a |
| Lenovo | Thinkagile Hx1521-R Firmware | before 8.88_cdi3a4a |
| Lenovo | Thinkagile Hx2320-E Firmware | before 8.88_cdi3a4a |
| Lenovo | Thinkagile Hx2321 Firmware | before 8.88_cdi3a4a |