CVE-2023-25495
First published: Fri Apr 28 2023(Updated: )
A valid, authenticated administrative user can query a web interface API to reveal the configured LDAP client password used by XCC to authenticate to an external LDAP server in certain configurations. There is no exposure where no LDAP client password is configured
Credit: psirt@lenovo.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| <2.93_afbt30p | ||
| <2.93_afbt30p | ||
| <2.93_afbt30p | ||
| <3.72_tei388s | ||
| <3.72_tei388s | ||
| <8.88_cdi3a4a | ||
| Lenovo Thinkagile Hx1320 | ||
| <8.88_cdi3a4a | ||
| Lenovo Thinkagile Hx1321 | ||
| <2.93_afbt30p | ||
| <8.88_cdi3a4a | ||
| Lenovo Thinkagile Hx1520-r | ||
| <8.88_cdi3a4a | ||
| Lenovo Thinkagile Hx1521-r | ||
| <8.88_cdi3a4a | ||
| Lenovo Thinkagile Hx2320-e | ||
| <8.88_cdi3a4a | ||
| Lenovo Thinkagile Hx2321 | ||
| <2.93_afbt30p | ||
| =2.93_afbt30p | ||
| <2.93_afbt30p | ||
| <3.72_tei388s | ||
| <8.88_cdi3a4a | ||
| Lenovo Thinkagile Hx3320 | ||
| <8.88_cdi3a4a | ||
| Lenovo Thinkagile Hx3321 | ||
| <2.93_afbt30p | ||
| <2.93_afbt30p | ||
| <4.71_d8bt48p | ||
| <4.71_d8bt48p | ||
| Lenovo Thinkagile Hx3375 | ||
| <8.88_cdi3a4a | ||
| Lenovo Thinkagile Hx3376 | ||
| <8.88_cdi3a4a | ||
| Lenovo Thinkagile Hx3520-g | ||
| <3.72_tei388s | ||
| Lenovo Thinkagile Hx3521-g | ||
| <3.72_tei388s | ||
| Lenovo Thinkagile Hx3720 | ||
| <8.88_cdi3a4a | ||
| <8.88_cdi3a4a | ||
| Lenovo Thinkagile Hx5520 | ||
| <8.88_cdi3a4a | ||
| Lenovo Thinkagile Hx5520-c | ||
| <8.88_cdi3a4a | ||
| Lenovo Thinkagile Hx5521 | ||
| <2.93_afbt30p | ||
| Lenovo Thinkagile Hx5521-c | ||
| <8.88_cdi3a4a | ||
| <8.88_cdi3a4a | ||
| Lenovo Thinkagile Hx7520 | ||
| <2.93_afbt30p | ||
| Lenovo Thinkagile Hx7521 | ||
| <2.93_afbt30p | ||
| <2.75_psi348s | ||
| <2.75_psi348s | ||
| Lenovo Thinkagile Hx7820 | ||
| <3.72_tei388s | ||
| Lenovo Thinkagile Hx7821 | ||
| <2.93_afbt30p | ||
| Lenovo Thinkagile Mx1020 | ||
| <2.93_afbt30p | ||
| <2.93_afbt30p | ||
| <2.93_afbt30p | ||
| <2.93_afbt30p | ||
| <2.93_afbt30p | ||
| <2.93_afbt30p | ||
| <2.93_afbt30p | ||
| <3.72_tei388s | ||
| <3.72_tei388s | ||
| <3.72_tei388s | ||
| <3.72_tei388s | ||
| <2.75_psi348s | ||
| <3.72_tei388s | ||
| <8.88_cdi3a4a | ||
| Lenovo Thinkagile Vx2320 | ||
| <2.93_afbt30p | ||
| <8.88_cdi3a4a | ||
| Lenovo Thinkagile Vx3320 | ||
| <2.93_afbt30p | ||
| <8.88_cdi3a4a | ||
| Lenovo Thinkagile Vx3520-g | ||
| <2.93_afbt30p | ||
| <3.72_tei388s | ||
| <8.88_cdi3a4a | ||
| Lenovo Thinkagile Vx5520 | ||
| <2.93_afbt30p | ||
| <8.88_cdi3a4a | ||
| Lenovo Thinkagile Vx7320 N | ||
| <2.93_afbt30p | ||
| <8.88_cdi3a4a | ||
| Lenovo Thinkagile Vx7520 | ||
| <8.88_cdi3a4a | ||
| Lenovo Thinkagile Vx7520 N | ||
| <2.93_afbt30p | ||
| <2.93_afbt30p | ||
| <2.75_psi348s | ||
| <1.60_usx324o | ||
| Lenovo Thinkstation P920 Firmware | <8.88_cdi3a4a | |
| Lenovo Thinkstation P920 | ||
| <3.72_tei388s | ||
| Lenovo Thinksystem Sd530 | ||
| <2.60_tgbt42h | ||
| <3.72_tei388s | ||
| Lenovo Thinksystem Sd650 | ||
| <2.60_tgbt42h | ||
| <2.60_tgbt42h | ||
| <3.72_tei388s | ||
| Lenovo Thinksystem Se350 | ||
| <3.72_tei388s | ||
| Lenovo Thinksystem Sn550 | ||
| <2.60_tgbt42h | ||
| <3.72_tei388s | ||
| Lenovo Thinksystem Sn850 | ||
| <3.72_tei388s | ||
| Lenovo Thinksystem Sr150 | ||
| <3.72_tei388s | ||
| Lenovo Thinksystem Sr158 | ||
| <3.72_tei388s | ||
| Lenovo Thinksystem Sr250 | ||
| <2.60_tgbt42h | ||
| <3.72_tei388s | ||
| Lenovo Thinksystem Sr258 | ||
| <2.60_tgbt42h | ||
| <8.88_cdi3a4a | ||
| Lenovo Thinksystem Sr530 | ||
| <8.88_cdi3a4a | ||
| Lenovo Thinksystem Sr550 | ||
| <8.88_cdi3a4a | ||
| Lenovo Thinksystem Sr570 | ||
| <8.88_cdi3a4a | ||
| Lenovo Thinksystem Sr590 | ||
| Lenovo Thinksystem Sr630 Firmware | <8.88_cdi3a4a | |
| Lenovo Thinksystem Sr630 | ||
| <2.93_afbt30p | ||
| <4.71_d8bt48p | ||
| Lenovo Thinksystem Sr645 | ||
| <4.71_d8bt48p | ||
| <8.88_cdi3a4a | ||
| Lenovo Thinksystem Sr650 | ||
| <2.93_afbt30p | ||
| <4.71_d8bt48p | ||
| Lenovo Thinksystem Sr665 | ||
| <4.71_d8bt48p | ||
| <3.72_tei388s | ||
| Lenovo Thinksystem Sr670 | ||
| <2.60_tgbt42h | ||
| <3.72_tei388s | ||
| Lenovo Thinksystem Sr850 | ||
| <2.60_tgbt42h | ||
| <3.72_tei388s | ||
| Lenovo Thinksystem Sr850p | ||
| <3.72_tei388s | ||
| Lenovo Thinksystem Sr860 | ||
| <2.60_tgbt42h | ||
| <2.75_psi348s | ||
| Lenovo Thinksystem Sr950 | ||
| <3.72_tei388s | ||
| Lenovo Thinksystem St250 | ||
| <2.60_tgbt42h | ||
| <3.72_tei388s | ||
| Lenovo Thinksystem St258 | ||
| <2.60_tgbt42h | ||
| <8.88_cdi3a4a | ||
| Lenovo Thinksystem St550 | ||
| <2.60_tgbt42h | ||
| <2.60_tgbt42h | ||
Remedy
Customers should update to the version (or later) of Lenovo XClarity Controller (XCC) identified in the related Lenovo Product Security Advisory: https://support.lenovo.com/us/en/product_security/LEN-99936 https://support.lenovo.com/us/en/product_security/LEN-99936
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- collector/nvd-index
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/author
- agent/weakness
- agent/severity
- agent/remedy
- agent/last-modified-date
- agent/references
- agent/tags
- agent/description
- agent/event
- agent/first-publish-date
- vendor/lenovo
- canonical/lenovo thinkagile hx1320
- canonical/lenovo thinkagile hx1321
- canonical/lenovo thinkagile hx1520-r
- canonical/lenovo thinkagile hx1521-r
- canonical/lenovo thinkagile hx2320-e
- canonical/lenovo thinkagile hx2321
- canonical/lenovo thinkagile hx3320
- canonical/lenovo thinkagile hx3321
- canonical/lenovo thinkagile hx3375
- canonical/lenovo thinkagile hx3376
- canonical/lenovo thinkagile hx3520-g
- canonical/lenovo thinkagile hx3521-g
- canonical/lenovo thinkagile hx3720
- canonical/lenovo thinkagile hx5520
- canonical/lenovo thinkagile hx5520-c
- canonical/lenovo thinkagile hx5521
- canonical/lenovo thinkagile hx5521-c
- canonical/lenovo thinkagile hx7520
- canonical/lenovo thinkagile hx7521
- canonical/lenovo thinkagile hx7820
- canonical/lenovo thinkagile hx7821
- canonical/lenovo thinkagile mx1020
- canonical/lenovo thinkagile vx2320
- canonical/lenovo thinkagile vx3320
- canonical/lenovo thinkagile vx3520-g
- canonical/lenovo thinkagile vx5520
- canonical/lenovo thinkagile vx7320 n
- canonical/lenovo thinkagile vx7520
- canonical/lenovo thinkagile vx7520 n
- canonical/lenovo thinkstation p920 firmware
- canonical/lenovo thinkstation p920
- canonical/lenovo thinksystem sd530
- canonical/lenovo thinksystem sd650
- canonical/lenovo thinksystem se350
- canonical/lenovo thinksystem sn550
- canonical/lenovo thinksystem sn850
- canonical/lenovo thinksystem sr150
- canonical/lenovo thinksystem sr158
- canonical/lenovo thinksystem sr250
- canonical/lenovo thinksystem sr258
- canonical/lenovo thinksystem sr530
- canonical/lenovo thinksystem sr550
- canonical/lenovo thinksystem sr570
- canonical/lenovo thinksystem sr590
- canonical/lenovo thinksystem sr630 firmware
- canonical/lenovo thinksystem sr630
- canonical/lenovo thinksystem sr645
- canonical/lenovo thinksystem sr650
- canonical/lenovo thinksystem sr665
- canonical/lenovo thinksystem sr670
- canonical/lenovo thinksystem sr850
- canonical/lenovo thinksystem sr850p
- canonical/lenovo thinksystem sr860
- canonical/lenovo thinksystem sr950
- canonical/lenovo thinksystem st250
- canonical/lenovo thinksystem st258
- canonical/lenovo thinksystem st550