CVE-2023-34421

CWE-20 — Improper Input Validation3 documents3 sources

Severity

6.5MEDIUM

EPSS

0.1%

top 69.38%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Lenovo Xclarity Administrator Lenovo Lenovo Xclarity Administrator

Timeline

PublishedJun 26

Description

A valid, authenticated LXCA user with elevated privileges may be able to replace filesystem data through a specifically crafted web API call due to insufficient input validation.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:HExploitability: 1.2 | Impact: 5.2

Affected Packages2 packages

▶NVDlenovo/xclarity_administrator< 4.0.0

▶CVEListV5lenovo/lenovo_xclarity_administratorVersions prior to 4.0

🔴Vulnerability Details

CVEList

CVE-2023-34421: A valid, authenticated LXCA user with elevated privileges may be able to replace filesystem data through a specifically crafted web API call due to in↗2023-06-26

▶

GHSA

GHSA-ffhh-2385-v666: A valid, authenticated LXCA user with elevated privileges may be able to replace filesystem data through a specifically crafted web API call due to in↗2023-06-26

▶