high7.5
CVE-2023-4607
An authenticated XCC user can change permissions for any user through a crafted API command.
Impact
An authenticated XCC user can change permissions for any user through a crafted API command.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Lenovo | Thinkagile Hx5530 Firmware | All versions |
| Lenovo | Thinkagile Hx7530 Firmware | All versions |
| Lenovo | Thinkagile Vx3331 Firmware | All versions |
| Lenovo | Thinkagile Hx1331 Firmware | All versions |
| Lenovo | Thinkagile Hx2330 Firmware | All versions |
| Lenovo | Thinkagile Hx2331 Firmware | All versions |
| Lenovo | Thinkagile Hx3330 Firmware | All versions |
| Lenovo | Thinkagile Hx3331 Firmware | All versions |
| Lenovo | Thinkagile Hx3375 Firmware | All versions |
| Lenovo | Thinkagile Hx3376 Firmware | All versions |
| Lenovo | Thinkagile Hx5531 Firmware | All versions |
| Lenovo | Thinkagile Hx7531 Firmware | All versions |