CVE-2023-4607 An authenticated XCC user can change permissions for any user through a crafted API command

Description

An authenticated XCC user can change permissions for any user through a crafted API command.

Affected products and versions

Product	Affected versions	Fixed in
Lenovo XClarity Controller (XCC)	Versions not published

Other CVEs of Lenovo XClarity Controller (XCC)

The 4 CVEs of Lenovo XClarity Controller (XCC) →

CVE-2023-4608 An authenticated XCC user with elevated privileges can perform blind SQL injection in limited cases through a crafted… 4.1 Medium CVE-2023-4606 An authenticated XCC user with Read-Only permission can change a different user’s password through a crafted API… 8.1 High CVE-2019-6187 A stored CSV Injection vulnerability was reported in Lenovo XClarity Controller (XCC) that could allow an administrative… Not rated