CVE-2023-29058 MEDIUM

CVE-2023-29058

Vendor Lenovo
Product XClarity Controller
Weakness CWE-276
Published April 28, 2023
Last update January 30, 2025
View on NVD All CVEs

CVSS base score

6.4/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction Required
Confidentiality Low
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:H/A:H

What the vulnerability does

01Description

A valid, authenticated XCC user with read-only permissions can modify custom user roles on other user accounts and the user trespass message through the XCC CLI. There is no exposure if SSH is disabled or if there are no users assigned optional read-only permissions.

Key dates

02Disclosure timeline

April 28, 2023 CVE published
January 30, 2025 Record updated