CVE-2023-0683: Input Validation
Published May 1, 2023
ยทUpdated
A valid, authenticated XCC user with read only access may gain elevated privileges through a specifically crafted API call.
Affected Software
221 affected components
Lenovo Thinkagile Hx5530 Firmware<2.93_afbt30p
Lenovo Thinkagile Hx5530
Lenovo Thinkagile Hx7530 Firmware<2.93_afbt30p
Lenovo Thinkagile Hx7530
Lenovo Thinkagile Vx3331 Firmware<2.93_afbt30p
Lenovo Thinkagile Vx3331
Lenovo Thinkagile Hx Enclosure Firmware<3.72_tei388s
Lenovo Thinkagile Hx Enclosure
Lenovo Thinkagile Hx1021 Firmware<3.72_tei388s
Lenovo Thinkagile Hx1021
Lenovo Thinkagile Hx1320 Firmware<8.88_cdi3a4a
Lenovo Thinkagile Hx1320
Lenovo Thinkagile Hx1321 Firmware<8.88_cdi3a4a
Lenovo Thinkagile Hx1321
Lenovo Thinkagile Hx1331 Firmware<2.93_afbt30p
Lenovo Thinkagile Hx1331
Lenovo Thinkagile Hx1520-r Firmware<8.88_cdi3a4a
Lenovo Thinkagile Hx1520-r
Lenovo Thinkagile Hx1521-r Firmware<8.88_cdi3a4a
Lenovo Thinkagile Hx1521-r
Lenovo Thinkagile Hx2320-e Firmware<8.88_cdi3a4a
Lenovo Thinkagile Hx2320-e
Lenovo Thinkagile Hx2321 Firmware<8.88_cdi3a4a
Lenovo Thinkagile Hx2321
Lenovo Thinkagile Hx2330 Firmware<2.93_afbt30p
Lenovo Thinkagile Hx2330 Firmware=2.93_afbt30p
Lenovo Thinkagile Hx2330
Lenovo Thinkagile Hx2331 Firmware<2.93_afbt30p
Lenovo Thinkagile Hx2331
Lenovo Thinkagile Hx2720-e Firmware<3.72_tei388s
Lenovo Thinkagile Hx2720-e
Lenovo Thinkagile Hx3320 Firmware<8.88_cdi3a4a
Lenovo Thinkagile Hx3320
Lenovo Thinkagile Hx3321 Firmware<8.88_cdi3a4a
Lenovo Thinkagile Hx3321
Lenovo Thinkagile Hx3330 Firmware<2.93_afbt30p
Lenovo Thinkagile Hx3330
Lenovo Thinkagile Hx3331 Firmware<2.93_afbt30p
Lenovo Thinkagile Hx3331
Lenovo Thinkagile Hx3331 Firmware<4.71_d8bt48p
Lenovo Thinkagile Hx3375 Firmware<4.71_d8bt48p
Lenovo Thinkagile Hx3375
Lenovo Thinkagile Hx3376 Firmware<8.88_cdi3a4a
Lenovo Thinkagile Hx3376
Lenovo Thinkagile Hx3520-g Firmware<8.88_cdi3a4a
Lenovo Thinkagile Hx3520-g
Lenovo Thinkagile Hx3521-g Firmware<3.72_tei388s
Lenovo Thinkagile Hx3521-g
Lenovo Thinkagile Hx3720 Firmware<3.72_tei388s
Lenovo Thinkagile Hx3720
Lenovo Thinkagile Hx3721 Firmware<8.88_cdi3a4a
Lenovo Thinkagile Hx3721
Lenovo Thinkagile Hx5520 Firmware<8.88_cdi3a4a
Lenovo Thinkagile Hx5520
Lenovo Thinkagile Hx5520-c Firmware<8.88_cdi3a4a
Lenovo Thinkagile Hx5520-c
Lenovo Thinkagile Hx5521 Firmware<8.88_cdi3a4a
Lenovo Thinkagile Hx5521
Lenovo Thinkagile Hx5521-c Firmware<2.93_afbt30p
Lenovo Thinkagile Hx5521-c
Lenovo Thinkagile Hx5531 Firmware<8.88_cdi3a4a
Lenovo Thinkagile Hx5531
Lenovo Thinkagile Hx7520 Firmware<8.88_cdi3a4a
Lenovo Thinkagile Hx7520
Lenovo Thinkagile Hx7521 Firmware<2.93_afbt30p
Lenovo Thinkagile Hx7521
Lenovo Thinkagile Hx7531 Firmware<2.93_afbt30p
Lenovo Thinkagile Hx7531
Lenovo Thinkagile Hx7531 Firmware<2.75_psi348s
Lenovo Thinkagile Hx7820 Firmware<2.75_psi348s
Lenovo Thinkagile Hx7820
Lenovo Thinkagile Hx7821 Firmware<3.72_tei388s
Lenovo Thinkagile Hx7821
Lenovo Thinkagile Mx1020 Firmware<2.93_afbt30p
Lenovo Thinkagile Mx1020
Lenovo Thinkagile Mx3330-f Firmware<2.93_afbt30p
Lenovo Thinkagile Mx3330-f
Lenovo Thinkagile Mx3330-h Firmware<2.93_afbt30p
Lenovo Thinkagile Mx3330-h
Lenovo Thinkagile Mx3331-f Firmware<2.93_afbt30p
Lenovo Thinkagile Mx3331-f
Lenovo Thinkagile Mx3331-h Firmware<2.93_afbt30p
Lenovo Thinkagile Mx3331-h
Lenovo Thinkagile Mx3530 F Firmware<2.93_afbt30p
Lenovo Thinkagile Mx3530 F
Lenovo Thinkagile Mx3530-h Firmware<2.93_afbt30p
Lenovo Thinkagile Mx3530-h
Lenovo Thinkagile Mx3531 H Firmware<2.93_afbt30p
Lenovo Thinkagile Mx3531 H
Lenovo Thinkagile Mx3531-f Firmware<3.72_tei388s
Lenovo Thinkagile Mx3531-f
Lenovo Thinkagile Mx1021 On Se350 Firmware<3.72_tei388s
Lenovo Thinkagile Mx1021 On Se350
Lenovo Thinkagile Vx 1se Firmware<3.72_tei388s
Lenovo Thinkagile Vx 1se
Lenovo Thinkagile Vx 2u4n Firmware<3.72_tei388s
Lenovo Thinkagile Vx 2u4n
Lenovo Thinkagile Vx 4u Firmware<2.75_psi348s
Lenovo Thinkagile Vx 4u
Lenovo Thinkagile Vx1320 Firmware<3.72_tei388s
Lenovo Thinkagile Vx1320
Lenovo Thinkagile Vx2320 Firmware<8.88_cdi3a4a
Lenovo Thinkagile Vx2320
Lenovo Thinkagile Vx2330 Firmware<2.93_afbt30p
Lenovo Thinkagile Vx2330
Lenovo Thinkagile Vx3320 Firmware<8.88_cdi3a4a
Lenovo Thinkagile Vx3320
Lenovo Thinkagile Vx3330 Firmware<2.93_afbt30p
Lenovo Thinkagile Vx3330
Lenovo Thinkagile Vx3520-g Firmware<8.88_cdi3a4a
Lenovo Thinkagile Vx3520-g
Lenovo Thinkagile Vx3530-g Firmware<2.93_afbt30p
Lenovo Thinkagile Vx3530-g
Lenovo Thinkagile Vx3720 Firmware<3.72_tei388s
Lenovo Thinkagile Vx3720
Lenovo Thinkagile Vx5520 Firmware<8.88_cdi3a4a
Lenovo Thinkagile Vx5520
Lenovo Thinkagile Vx5530 Firmware<2.93_afbt30p
Lenovo Thinkagile Vx5530
Lenovo Thinkagile Vx7320 N Firmware<8.88_cdi3a4a
Lenovo Thinkagile Vx7320 N
Lenovo Thinkagile Vx7330 Firmware<2.93_afbt30p
Lenovo Thinkagile Vx7330
Lenovo Thinkagile Vx7520 Firmware<8.88_cdi3a4a
Lenovo Thinkagile Vx7520
Lenovo Thinkagile Vx7520 N Firmware<8.88_cdi3a4a
Lenovo Thinkagile Vx7520 N
Lenovo Thinkagile Vx7530 Firmware<2.93_afbt30p
Lenovo Thinkagile Vx7530
Lenovo Thinkagile Vx7531 Firmware<2.93_afbt30p
Lenovo Thinkagile Vx7531
Lenovo Thinkagile Vx7820 Firmware<2.75_psi348s
Lenovo Thinkagile Vx7820
Lenovo Thinkedge Se450 Firmware<1.60_usx324o
Lenovo Thinkedge Se450
Lenovo Thinkstation P920 Firmware<8.88_cdi3a4a
Lenovo Thinkstation P920
Lenovo Thinksystem Sd530 Firmware<3.72_tei388s
Lenovo Thinksystem Sd530
Lenovo Thinksystem Sd630 V2 Firmware<2.60_tgbt42h
Lenovo Thinksystem Sd630 V2
Lenovo Thinksystem Sd650 Firmware<3.72_tei388s
Lenovo Thinksystem Sd650
Lenovo Thinksystem Sd650 V2 Firmware<2.60_tgbt42h
Lenovo Thinksystem Sd650 V2
Lenovo Thinksystem Sd650-n V2 Firmware<2.60_tgbt42h
Lenovo Thinksystem Sd650-n V2
Lenovo Thinksystem Se350 Firmware<3.72_tei388s
Lenovo Thinksystem Se350
Lenovo Thinksystem Sn550 Firmware<3.72_tei388s
Lenovo Thinksystem Sn550
Lenovo Thinksystem Sn550 V2 Firmware<2.60_tgbt42h
Lenovo Thinksystem Sn550 V2
Lenovo Thinksystem Sn850 Firmware<3.72_tei388s
Lenovo Thinksystem Sn850
Lenovo Thinksystem Sr150 Firmware<3.72_tei388s
Lenovo Thinksystem Sr150
Lenovo Thinksystem Sr158 Firmware<3.72_tei388s
Lenovo Thinksystem Sr158
Lenovo Thinksystem Sr250 Firmware<3.72_tei388s
Lenovo Thinksystem Sr250
Lenovo Thinksystem Sr250 V2 Firmware<2.60_tgbt42h
Lenovo Thinksystem Sr250 V2
Lenovo Thinksystem Sr258 Firmware<3.72_tei388s
Lenovo Thinksystem Sr258
Lenovo Thinksystem Sr258 V2 Firmware<2.60_tgbt42h
Lenovo Thinksystem Sr258 V2
Lenovo Thinksystem Sr530 Firmware<8.88_cdi3a4a
Lenovo Thinksystem Sr530
Lenovo Thinksystem Sr550 Firmware<8.88_cdi3a4a
Lenovo Thinksystem Sr550
Lenovo Thinksystem Sr570 Firmware<8.88_cdi3a4a
Lenovo Thinksystem Sr570
Lenovo Thinksystem Sr590 Firmware<8.88_cdi3a4a
Lenovo Thinksystem Sr590
Lenovo Thinksystem Sr630 Firmware<8.88_cdi3a4a
Lenovo Thinksystem Sr630
Lenovo Thinksystem Sr630 V2 Firmware<2.93_afbt30p
Lenovo Thinksystem Sr630 V2
Lenovo Thinksystem Sr645 Firmware<4.71_d8bt48p
Lenovo Thinksystem Sr645
Lenovo Thinksystem Sr645 V3 Firmware<4.71_d8bt48p
Lenovo Thinksystem Sr645 V3
Lenovo Thinksystem Sr650 Firmware<8.88_cdi3a4a
Lenovo Thinksystem Sr650
Lenovo Thinksystem Sr650 V2 Firmware<2.93_afbt30p
Lenovo Thinksystem Sr650 V2
Lenovo Thinksystem Sr665 Firmware<4.71_d8bt48p
Lenovo Thinksystem Sr665
Lenovo Thinksystem Sr665 V3 Firmware<4.71_d8bt48p
Lenovo Thinksystem Sr665 V3
Lenovo Thinksystem Sr670 Firmware<3.72_tei388s
Lenovo Thinksystem Sr670
Lenovo Thinksystem Sr670 V2 Firmware<2.60_tgbt42h
Lenovo Thinksystem Sr670 V2
Lenovo Thinksystem Sr850 Firmware<3.72_tei388s
Lenovo Thinksystem Sr850
Lenovo Thinksystem Sr850 V2 Firmware<2.60_tgbt42h
Lenovo Thinksystem Sr850 V2
Lenovo Thinksystem Sr850p Firmware<3.72_tei388s
Lenovo Thinksystem Sr850p
Lenovo Thinksystem Sr860 Firmware<3.72_tei388s
Lenovo Thinksystem Sr860
Lenovo Thinksystem Sr860 V2 Firmware<2.60_tgbt42h
Lenovo Thinksystem Sr860 V2
Lenovo Thinksystem Sr950 Firmware<2.75_psi348s
Lenovo Thinksystem Sr950
Lenovo Thinksystem St250 Firmware<3.72_tei388s
Lenovo Thinksystem St250
Lenovo Thinksystem St250 V2 Firmware<2.60_tgbt42h
Lenovo Thinksystem St250 V2
Lenovo Thinksystem St258 Firmware<3.72_tei388s
Lenovo Thinksystem St258
Lenovo Thinksystem St258 V2 Firmware<2.60_tgbt42h
Lenovo Thinksystem St258 V2
Lenovo Thinksystem St550 Firmware<8.88_cdi3a4a
Lenovo Thinksystem St550
Lenovo Thinksystem St650 V2 Firmware<2.60_tgbt42h
Lenovo Thinksystem St650 V2
Lenovo Thinksystem St658 V2 Firmware<2.60_tgbt42h
Lenovo Thinksystem St658 V2
Remediation
Information
Customers should update to the version (or later) of Lenovo XClarity Controller (XCC) identified in the related Lenovo Product Security Advisory:
https://support.lenovo.com/us/en/product_security/LEN-99936 https://support.lenovo.com/us/en/product_security/LEN-99936
Event History
May 1, 2023
CVE Published
via MITREยท02:23 PM
Data Sourced
via MITREยท02:23 PM
RemedyDescriptionSeverityWeakness
Data Sourced
03:15 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2023-0683?
CVE-2023-0683 is classified as a high severity vulnerability that allows authenticated users to gain elevated privileges.
2
How do I fix CVE-2023-0683?
To fix CVE-2023-0683, update to the latest firmware version that addresses this vulnerability as recommended by Lenovo.
3
What systems are affected by CVE-2023-0683?
CVE-2023-0683 affects multiple Lenovo ThinkAgile systems with specific firmware versions, including HX5530, HX7530, and others around version 2.93_afbt30p.
4
Can an unauthenticated user exploit CVE-2023-0683?
No, CVE-2023-0683 requires an authenticated user with read-only access to exploit the vulnerability.
5
What type of attack is CVE-2023-0683 associated with?
CVE-2023-0683 is associated with privilege escalation attacks through crafted API calls.