CVE-2023-29057

CWE-276 — Incorrect Default Permissions3 documents3 sources
Severity
8.8HIGH
EPSS
0.2%
top 63.87%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
110
Lenovo Thinkagile Hx1021 FirmwareLenovo Thinkagile Hx1320 FirmwareLenovo Thinkagile Hx1321 Firmware+107 more
Timeline
PublishedApr 28
Latest updateJul 6

Description

A valid XCC user's local account permissions overrides their active directory permissions under specific configurations. This could lead to a privilege escalation. To be vulnerable, LDAP must be configured for authentication/authorization and logins configured as “Local First, then LDAP”.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:HExploitability: 2.1 | Impact: 5.2

Affected Packages110 packages

🔴Vulnerability Details

2
GHSA
GHSA-9gph-8xxh-c4w6: A valid XCC user's local account permissions overrides their active directory permissions under specific configurations↗2023-07-06
▶
CVEList
CVE-2023-29057: A valid XCC user's local account permissions overrides their active directory permissions under specific configurations↗2023-04-28
▶