CVE Feed

    Dashboard / CVE / CVE-2023-29056

    CVE-2023-29056

    A valid LDAP user, under specific conditions, will default to read-only permissions when authenticating into XCC. To be vulnerable, XCC must be configured to use an LDAP server for Authentication/Authorization and have the login permission attribute not defined.

    Published:Apr 28, 2023
    Last Modified:Jan 30, 2025
    EPS:Apr 28, 2023
    EPSS Score:0.00151
    CVSS Score:5.3

    Affected Products

    Vendor
    Lenovo
    Product
    Thinkagile Hx1021
    Vendor
    Lenovo
    Product
    Thinkagile Hx1021 Firmware
    Vendor
    Lenovo
    Product
    Thinkagile Hx1320
    Vendor
    Lenovo
    Product
    Thinkagile Hx1320 Firmware
    Vendor
    Lenovo
    Product
    Thinkagile Hx1321
    Vendor
    Lenovo
    Product
    Thinkagile Hx1321 Firmware
    Vendor
    Lenovo
    Product
    Thinkagile Hx1331
    Vendor
    Lenovo
    Product
    Thinkagile Hx1331 Firmware
    Vendor
    Lenovo
    Product
    Thinkagile Hx1520-r
    Vendor
    Lenovo
    Product
    Thinkagile Hx1520-r Firmware
    Vendor
    Lenovo
    Product
    Thinkagile Hx1521-r
    Vendor
    Lenovo
    Product
    Thinkagile Hx1521-r Firmware
    Vendor
    Lenovo
    Product
    Thinkagile Hx2320-e
    Vendor
    Lenovo
    Product
    Thinkagile Hx2320-e Firmware
    Vendor
    Lenovo
    Product
    Thinkagile Hx2321
    Vendor
    Lenovo
    Product
    Thinkagile Hx2321 Firmware
    Vendor
    Lenovo
    Product
    Thinkagile Hx2330
    Vendor
    Lenovo
    Product
    Thinkagile Hx2330 Firmware
    Vendor
    Lenovo
    Product
    Thinkagile Hx2331
    Vendor
    Lenovo
    Product
    Thinkagile Hx2331 Firmware
    Vendor
    Lenovo
    Product
    Thinkagile Hx2720-e
    Vendor
    Lenovo
    Product
    Thinkagile Hx2720-e Firmware
    Vendor
    Lenovo
    Product
    Thinkagile Hx3320
    Vendor
    Lenovo
    Product
    Thinkagile Hx3320 Firmware
    Vendor
    Lenovo
    Product
    Thinkagile Hx3321
    Vendor
    Lenovo
    Product
    Thinkagile Hx3321 Firmware
    Vendor
    Lenovo
    Product
    Thinkagile Hx3330
    Vendor
    Lenovo
    Product
    Thinkagile Hx3330 Firmware
    Vendor
    Lenovo
    Product
    Thinkagile Hx3331
    Vendor
    Lenovo
    Product
    Thinkagile Hx3331 Firmware
    Vendor
    Lenovo
    Product
    Thinkagile Hx3375
    Vendor
    Lenovo
    Product
    Thinkagile Hx3375 Firmware
    Vendor
    Lenovo
    Product
    Thinkagile Hx3376
    Vendor
    Lenovo
    Product
    Thinkagile Hx3376 Firmware
    Vendor
    Lenovo
    Product
    Thinkagile Hx3520-g
    Vendor
    Lenovo
    Product
    Thinkagile Hx3520-g Firmware
    Vendor
    Lenovo
    Product
    Thinkagile Hx3521-g
    Vendor
    Lenovo
    Product
    Thinkagile Hx3521-g Firmware
    Vendor
    Lenovo
    Product
    Thinkagile Hx3720
    Vendor
    Lenovo
    Product
    Thinkagile Hx3720 Firmware
    Vendor
    Lenovo
    Product
    Thinkagile Hx3721
    Vendor
    Lenovo
    Product
    Thinkagile Hx3721 Firmware
    Vendor
    Lenovo
    Product
    Thinkagile Hx5520
    Vendor
    Lenovo
    Product
    Thinkagile Hx5520-c
    Vendor
    Lenovo
    Product
    Thinkagile Hx5520-c Firmware
    Vendor
    Lenovo
    Product
    Thinkagile Hx5520 Firmware
    Vendor
    Lenovo
    Product
    Thinkagile Hx5521
    Vendor
    Lenovo
    Product
    Thinkagile Hx5521-c
    Vendor
    Lenovo
    Product
    Thinkagile Hx5521-c Firmware
    Vendor
    Lenovo
    Product
    Thinkagile Hx5521 Firmware
    Vendor
    Lenovo
    Product
    Thinkagile Hx5530
    Vendor
    Lenovo
    Product
    Thinkagile Hx5530 Firmware
    Vendor
    Lenovo
    Product
    Thinkagile Hx5531
    Vendor
    Lenovo
    Product
    Thinkagile Hx5531 Firmware
    Vendor
    Lenovo
    Product
    Thinkagile Hx7520
    Vendor
    Lenovo
    Product
    Thinkagile Hx7520 Firmware
    Vendor
    Lenovo
    Product
    Thinkagile Hx7521
    Vendor
    Lenovo
    Product
    Thinkagile Hx7521 Firmware
    Vendor
    Lenovo
    Product
    Thinkagile Hx7530
    Vendor
    Lenovo
    Product
    Thinkagile Hx7530 Firmware
    Vendor
    Lenovo
    Product
    Thinkagile Hx7531
    Vendor
    Lenovo
    Product
    Thinkagile Hx7531 Firmware
    Vendor
    Lenovo
    Product
    Thinkagile Hx7820
    Vendor
    Lenovo
    Product
    Thinkagile Hx7820 Firmware
    Vendor
    Lenovo
    Product
    Thinkagile Hx7821
    Vendor
    Lenovo
    Product
    Thinkagile Hx7821 Firmware
    Vendor
    Lenovo
    Product
    Thinkagile Hx Enclosure
    Vendor
    Lenovo
    Product
    Thinkagile Hx Enclosure Firmware
    Vendor
    Lenovo
    Product
    Thinkagile Mx1020
    Vendor
    Lenovo
    Product
    Thinkagile Mx1020 Firmware
    Vendor
    Lenovo
    Product
    Thinkagile Mx1021 On Se350
    Vendor
    Lenovo
    Product
    Thinkagile Mx1021 On Se350 Firmware
    Vendor
    Lenovo
    Product
    Thinkagile Mx3330-f
    Vendor
    Lenovo
    Product
    Thinkagile Mx3330-f Firmware
    Vendor
    Lenovo
    Product
    Thinkagile Mx3330-h
    Vendor
    Lenovo
    Product
    Thinkagile Mx3330-h Firmware
    Vendor
    Lenovo
    Product
    Thinkagile Mx3331-f
    Vendor
    Lenovo
    Product
    Thinkagile Mx3331-f Firmware
    Vendor
    Lenovo
    Product
    Thinkagile Mx3331-h
    Vendor
    Lenovo
    Product
    Thinkagile Mx3331-h Firmware
    Vendor
    Lenovo
    Product
    Thinkagile Mx3530-h
    Vendor
    Lenovo
    Product
    Thinkagile Mx3530-h Firmware
    Vendor
    Lenovo
    Product
    Thinkagile Mx3530 F
    Vendor
    Lenovo
    Product
    Thinkagile Mx3530 F Firmware
    Vendor
    Lenovo
    Product
    Thinkagile Mx3531-f
    Vendor
    Lenovo
    Product
    Thinkagile Mx3531-f Firmware
    Vendor
    Lenovo
    Product
    Thinkagile Mx3531 H
    Vendor
    Lenovo
    Product
    Thinkagile Mx3531 H Firmware
    Vendor
    Lenovo
    Product
    Thinkagile Vx1320
    Vendor
    Lenovo
    Product
    Thinkagile Vx1320 Firmware
    Vendor
    Lenovo
    Product
    Thinkagile Vx2320
    Vendor
    Lenovo
    Product
    Thinkagile Vx2320 Firmware
    Vendor
    Lenovo
    Product
    Thinkagile Vx2330
    Vendor
    Lenovo
    Product
    Thinkagile Vx2330 Firmware
    Vendor
    Lenovo
    Product
    Thinkagile Vx3320
    Vendor
    Lenovo
    Product
    Thinkagile Vx3320 Firmware
    Vendor
    Lenovo
    Product
    Thinkagile Vx3330
    Vendor
    Lenovo
    Product
    Thinkagile Vx3330 Firmware
    Vendor
    Lenovo
    Product
    Thinkagile Vx3331
    Vendor
    Lenovo
    Product
    Thinkagile Vx3331 Firmware
    Vendor
    Lenovo
    Product
    Thinkagile Vx3520-g
    Vendor
    Lenovo
    Product
    Thinkagile Vx3520-g Firmware
    Vendor
    Lenovo
    Product
    Thinkagile Vx3530-g
    Vendor
    Lenovo
    Product
    Thinkagile Vx3530-g Firmware
    Vendor
    Lenovo
    Product
    Thinkagile Vx3720
    Vendor
    Lenovo
    Product
    Thinkagile Vx3720 Firmware
    Vendor
    Lenovo
    Product
    Thinkagile Vx5520
    Vendor
    Lenovo
    Product
    Thinkagile Vx5520 Firmware
    Vendor
    Lenovo
    Product
    Thinkagile Vx5530
    Vendor
    Lenovo
    Product
    Thinkagile Vx5530 Firmware
    Vendor
    Lenovo
    Product
    Thinkagile Vx7320 N
    Vendor
    Lenovo
    Product
    Thinkagile Vx7320 N Firmware
    Vendor
    Lenovo
    Product
    Thinkagile Vx7330
    Vendor
    Lenovo
    Product
    Thinkagile Vx7330 Firmware
    Vendor
    Lenovo
    Product
    Thinkagile Vx7520
    Vendor
    Lenovo
    Product
    Thinkagile Vx7520 Firmware
    Vendor
    Lenovo
    Product
    Thinkagile Vx7520 N
    Vendor
    Lenovo
    Product
    Thinkagile Vx7520 N Firmware
    Vendor
    Lenovo
    Product
    Thinkagile Vx7530
    Vendor
    Lenovo
    Product
    Thinkagile Vx7530 Firmware
    Vendor
    Lenovo
    Product
    Thinkagile Vx7531
    Vendor
    Lenovo
    Product
    Thinkagile Vx7531 Firmware
    Vendor
    Lenovo
    Product
    Thinkagile Vx7820
    Vendor
    Lenovo
    Product
    Thinkagile Vx7820 Firmware
    Vendor
    Lenovo
    Product
    Thinkagile Vx 1se
    Vendor
    Lenovo
    Product
    Thinkagile Vx 1se Firmware
    Vendor
    Lenovo
    Product
    Thinkagile Vx 2u4n
    Vendor
    Lenovo
    Product
    Thinkagile Vx 2u4n Firmware
    Vendor
    Lenovo
    Product
    Thinkagile Vx 4u
    Vendor
    Lenovo
    Product
    Thinkagile Vx 4u Firmware
    Vendor
    Lenovo
    Product
    Thinkedge Se450
    Vendor
    Lenovo
    Product
    Thinkedge Se450 Firmware
    Vendor
    Lenovo
    Product
    Thinkstation P920
    Vendor
    Lenovo
    Product
    Thinkstation P920 Firmware
    Vendor
    Lenovo
    Product
    Thinksystem Sd530
    Vendor
    Lenovo
    Product
    Thinksystem Sd530 Firmware
    Vendor
    Lenovo
    Product
    Thinksystem Sd630 V2
    Vendor
    Lenovo
    Product
    Thinksystem Sd630 V2 Firmware
    Vendor
    Lenovo
    Product
    Thinksystem Sd650
    Vendor
    Lenovo
    Product
    Thinksystem Sd650-n V2
    Vendor
    Lenovo
    Product
    Thinksystem Sd650-n V2 Firmware
    Vendor
    Lenovo
    Product
    Thinksystem Sd650 Firmware
    Vendor
    Lenovo
    Product
    Thinksystem Sd650 V2
    Vendor
    Lenovo
    Product
    Thinksystem Sd650 V2 Firmware
    Vendor
    Lenovo
    Product
    Thinksystem Se350
    Vendor
    Lenovo
    Product
    Thinksystem Se350 Firmware
    Vendor
    Lenovo
    Product
    Thinksystem Sn550
    Vendor
    Lenovo
    Product
    Thinksystem Sn550 Firmware
    Vendor
    Lenovo
    Product
    Thinksystem Sn550 V2
    Vendor
    Lenovo
    Product
    Thinksystem Sn550 V2 Firmware
    Vendor
    Lenovo
    Product
    Thinksystem Sn850
    Vendor
    Lenovo
    Product
    Thinksystem Sn850 Firmware
    Vendor
    Lenovo
    Product
    Thinksystem Sr150
    Vendor
    Lenovo
    Product
    Thinksystem Sr150 Firmware
    Vendor
    Lenovo
    Product
    Thinksystem Sr158
    Vendor
    Lenovo
    Product
    Thinksystem Sr158 Firmware
    Vendor
    Lenovo
    Product
    Thinksystem Sr250
    Vendor
    Lenovo
    Product
    Thinksystem Sr250 Firmware
    Vendor
    Lenovo
    Product
    Thinksystem Sr250 V2
    Vendor
    Lenovo
    Product
    Thinksystem Sr250 V2 Firmware
    Vendor
    Lenovo
    Product
    Thinksystem Sr258
    Vendor
    Lenovo
    Product
    Thinksystem Sr258 Firmware
    Vendor
    Lenovo
    Product
    Thinksystem Sr258 V2
    Vendor
    Lenovo
    Product
    Thinksystem Sr258 V2 Firmware
    Vendor
    Lenovo
    Product
    Thinksystem Sr530
    Vendor
    Lenovo
    Product
    Thinksystem Sr530 Firmware
    Vendor
    Lenovo
    Product
    Thinksystem Sr550
    Vendor
    Lenovo
    Product
    Thinksystem Sr550 Firmware
    Vendor
    Lenovo
    Product
    Thinksystem Sr570
    Vendor
    Lenovo
    Product
    Thinksystem Sr570 Firmware
    Vendor
    Lenovo
    Product
    Thinksystem Sr590
    Vendor
    Lenovo
    Product
    Thinksystem Sr590 Firmware
    Vendor
    Lenovo
    Product
    Thinksystem Sr630
    Vendor
    Lenovo
    Product
    Thinksystem Sr630 Firmware
    Vendor
    Lenovo
    Product
    Thinksystem Sr630 V2
    Vendor
    Lenovo
    Product
    Thinksystem Sr630 V2 Firmware
    Vendor
    Lenovo
    Product
    Thinksystem Sr645
    Vendor
    Lenovo
    Product
    Thinksystem Sr645 Firmware
    Vendor
    Lenovo
    Product
    Thinksystem Sr645 V3
    Vendor
    Lenovo
    Product
    Thinksystem Sr645 V3 Firmware
    Vendor
    Lenovo
    Product
    Thinksystem Sr650
    Vendor
    Lenovo
    Product
    Thinksystem Sr650 Firmware
    Vendor
    Lenovo
    Product
    Thinksystem Sr650 V2
    Vendor
    Lenovo
    Product
    Thinksystem Sr650 V2 Firmware
    Vendor
    Lenovo
    Product
    Thinksystem Sr665
    Vendor
    Lenovo
    Product
    Thinksystem Sr665 Firmware
    Vendor
    Lenovo
    Product
    Thinksystem Sr665 V3
    Vendor
    Lenovo
    Product
    Thinksystem Sr665 V3 Firmware
    Vendor
    Lenovo
    Product
    Thinksystem Sr670
    Vendor
    Lenovo
    Product
    Thinksystem Sr670 Firmware
    Vendor
    Lenovo
    Product
    Thinksystem Sr670 V2
    Vendor
    Lenovo
    Product
    Thinksystem Sr670 V2 Firmware
    Vendor
    Lenovo
    Product
    Thinksystem Sr850
    Vendor
    Lenovo
    Product
    Thinksystem Sr850 Firmware
    Vendor
    Lenovo
    Product
    Thinksystem Sr850 V2
    Vendor
    Lenovo
    Product
    Thinksystem Sr850 V2 Firmware
    Vendor
    Lenovo
    Product
    Thinksystem Sr850p
    Vendor
    Lenovo
    Product
    Thinksystem Sr850p Firmware
    Vendor
    Lenovo
    Product
    Thinksystem Sr860
    Vendor
    Lenovo
    Product
    Thinksystem Sr860 Firmware
    Vendor
    Lenovo
    Product
    Thinksystem Sr860 V2
    Vendor
    Lenovo
    Product
    Thinksystem Sr860 V2 Firmware
    Vendor
    Lenovo
    Product
    Thinksystem Sr950
    Vendor
    Lenovo
    Product
    Thinksystem Sr950 Firmware
    Vendor
    Lenovo
    Product
    Thinksystem St250
    Vendor
    Lenovo
    Product
    Thinksystem St250 Firmware
    Vendor
    Lenovo
    Product
    Thinksystem St250 V2
    Vendor
    Lenovo
    Product
    Thinksystem St250 V2 Firmware
    Vendor
    Lenovo
    Product
    Thinksystem St258
    Vendor
    Lenovo
    Product
    Thinksystem St258 Firmware
    Vendor
    Lenovo
    Product
    Thinksystem St258 V2
    Vendor
    Lenovo
    Product
    Thinksystem St258 V2 Firmware
    Vendor
    Lenovo
    Product
    Thinksystem St550
    Vendor
    Lenovo
    Product
    Thinksystem St550 Firmware
    Vendor
    Lenovo
    Product
    Thinksystem St650 V2
    Vendor
    Lenovo
    Product
    Thinksystem St650 V2 Firmware
    Vendor
    Lenovo
    Product
    Thinksystem St658 V2
    Vendor
    Lenovo
    Product
    Thinksystem St658 V2 Firmware

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-269 Improper Privilege Management

    Related CVEs

    CVE-2024-2659 (CVSS 7.2) — A command injection vulnerability was identified in SMM/SMM2 and FPC that could allow an authenticated user w…
    CVE-2023-0683 (CVSS 8.3) — A valid, authenticated XCC user with read only access may gain elevated privileges through a specifically craf…
    CVE-2023-25492 (CVSS 6.3) — A valid, authenticated user may be able to trigger a denial of service of the XCC web user interface or other …
    CVE-2023-25495 (CVSS 4.9) — A valid, authenticated administrative user can query a web interface API to reveal the configured LDAP client …
    CVE-2023-29057 (CVSS 7.3) — A valid XCC user's local account permissions overrides their active directory permissions under specific confi…
    CVE-2023-29058 (CVSS 6.4) — A valid, authenticated XCC user with read-only permissions can modify custom user roles on other user accounts…
    CVE-2022-34888 (CVSS 2.7) — The Remote Mount feature can potentially be abused by valid, authenticated users to make connections to intern…
    CVE-2022-34884 (CVSS 7.2) — A buffer overflow exists in the Remote Presence subsystem which can potentially allow valid, authenticated use…
    CVE-2022-40134 (CVSS 4.4) — An information leak vulnerability in the SMI Set BIOS Password SMI Handler in some Lenovo models may allow an …

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High