CVE-2023-4607 An authenticated XCC user can change permissions for any user through a crafted API command

Description

An authenticated XCC user can change permissions for any user through a crafted API command.

Produits et versions touchés

Produit	Versions touchées	Corrigé en
Lenovo XClarity Controller (XCC)	Versions non publiées

Autres CVE de Lenovo XClarity Controller (XCC)

Les 4 CVE de Lenovo XClarity Controller (XCC) →

CVE-2023-4608 An authenticated XCC user with elevated privileges can perform blind SQL injection in limited cases through a crafted… 4.1 Moyenne CVE-2023-4606 An authenticated XCC user with Read-Only permission can change a different user’s password through a crafted API… 8.1 Élevée CVE-2019-6187 A stored CSV Injection vulnerability was reported in Lenovo XClarity Controller (XCC) that could allow an administrative… Non notée