CVE-2023-29058

State: Published
Severity: 6.4 Medium
Published: Apr 28, 2023
Updated: Jan 30, 2025
Reserved: Mar 30, 2023

Description

A valid, authenticated XCC user with read-only permissions can modify custom user roles on other user accounts and the user trespass message through the XCC CLI. There is no exposure if SSH is disabled or if there are no users assigned optional read-only permissions.

Scores

CVSS	Score	Vector	Source
3.1	6.4 Medium	CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:H/A:H	lenovo

Weaknesses

CWE-276 Incorrect Default Permissions

Affected Products

Product	Versions
XClarity ControllerLenovo	Refer to Mitigation strategy section in LEN-118321Affected

References

https://support.lenovo.com/us/en/product_security/LEN-118321

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.