CVE-2023-29058
First published: Fri Apr 28 2023(Updated: )
A valid, authenticated XCC user with read-only permissions can modify custom user roles on other user accounts and the user trespass message through the XCC CLI. There is no exposure if SSH is disabled or if there are no users assigned optional read-only permissions.
Credit: psirt@lenovo.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| <2.93_afbt30p | ||
| <2.93_afbt30p | ||
| <2.93_afbt30p | ||
| <3.72_tei388s | ||
| <3.72_tei388s | ||
| <8.88_cdi3a4a | ||
| Lenovo Thinkagile Hx1320 | ||
| <8.88_cdi3a4a | ||
| Lenovo Thinkagile Hx1321 | ||
| <2.93_afbt30p | ||
| <8.88_cdi3a4a | ||
| Lenovo Thinkagile Hx1520-r | ||
| <8.88_cdi3a4a | ||
| Lenovo Thinkagile Hx1521-r | ||
| <8.88_cdi3a4a | ||
| Lenovo Thinkagile Hx2320-e | ||
| <8.88_cdi3a4a | ||
| Lenovo Thinkagile Hx2321 | ||
| <2.93_afbt30p | ||
| =2.93_afbt30p | ||
| <2.93_afbt30p | ||
| <3.72_tei388s | ||
| <8.88_cdi3a4a | ||
| Lenovo Thinkagile Hx3320 | ||
| <8.88_cdi3a4a | ||
| Lenovo Thinkagile Hx3321 | ||
| <2.93_afbt30p | ||
| <2.93_afbt30p | ||
| <4.71_d8bt48p | ||
| <4.71_d8bt48p | ||
| Lenovo Thinkagile Hx3375 | ||
| <8.88_cdi3a4a | ||
| Lenovo Thinkagile Hx3376 | ||
| <8.88_cdi3a4a | ||
| Lenovo Thinkagile Hx3520-g | ||
| <3.72_tei388s | ||
| Lenovo Thinkagile Hx3521-g | ||
| <3.72_tei388s | ||
| Lenovo Thinkagile Hx3720 | ||
| <8.88_cdi3a4a | ||
| <8.88_cdi3a4a | ||
| Lenovo Thinkagile Hx5520 | ||
| <8.88_cdi3a4a | ||
| Lenovo Thinkagile Hx5520-c | ||
| <8.88_cdi3a4a | ||
| Lenovo Thinkagile Hx5521 | ||
| <2.93_afbt30p | ||
| Lenovo Thinkagile Hx5521-c | ||
| <8.88_cdi3a4a | ||
| <8.88_cdi3a4a | ||
| Lenovo Thinkagile Hx7520 | ||
| <2.93_afbt30p | ||
| Lenovo Thinkagile Hx7521 | ||
| <2.93_afbt30p | ||
| <2.75_psi348s | ||
| <2.75_psi348s | ||
| Lenovo Thinkagile Hx7820 | ||
| <3.72_tei388s | ||
| Lenovo Thinkagile Hx7821 | ||
| <2.93_afbt30p | ||
| Lenovo Thinkagile Mx1020 | ||
| <2.93_afbt30p | ||
| <2.93_afbt30p | ||
| <2.93_afbt30p | ||
| <2.93_afbt30p | ||
| <2.93_afbt30p | ||
| <2.93_afbt30p | ||
| <2.93_afbt30p | ||
| <3.72_tei388s | ||
| <3.72_tei388s | ||
| <3.72_tei388s | ||
| <3.72_tei388s | ||
| <2.75_psi348s | ||
| <3.72_tei388s | ||
| <8.88_cdi3a4a | ||
| Lenovo Thinkagile Vx2320 | ||
| <2.93_afbt30p | ||
| <8.88_cdi3a4a | ||
| Lenovo Thinkagile Vx3320 | ||
| <2.93_afbt30p | ||
| <8.88_cdi3a4a | ||
| Lenovo Thinkagile Vx3520-g | ||
| <2.93_afbt30p | ||
| <3.72_tei388s | ||
| <8.88_cdi3a4a | ||
| Lenovo Thinkagile Vx5520 | ||
| <2.93_afbt30p | ||
| <8.88_cdi3a4a | ||
| Lenovo Thinkagile Vx7320 N | ||
| <2.93_afbt30p | ||
| <8.88_cdi3a4a | ||
| Lenovo Thinkagile Vx7520 | ||
| <8.88_cdi3a4a | ||
| Lenovo Thinkagile Vx7520 N | ||
| <2.93_afbt30p | ||
| <2.93_afbt30p | ||
| <2.75_psi348s | ||
| <1.60_usx324o | ||
| Lenovo Thinkstation P920 Firmware | <8.88_cdi3a4a | |
| Lenovo Thinkstation P920 | ||
| <3.72_tei388s | ||
| Lenovo Thinksystem Sd530 | ||
| <2.60_tgbt42h | ||
| <3.72_tei388s | ||
| Lenovo Thinksystem Sd650 | ||
| <2.60_tgbt42h | ||
| <2.60_tgbt42h | ||
| <3.72_tei388s | ||
| Lenovo Thinksystem Se350 | ||
| <3.72_tei388s | ||
| Lenovo Thinksystem Sn550 | ||
| <2.60_tgbt42h | ||
| <3.72_tei388s | ||
| Lenovo Thinksystem Sn850 | ||
| <3.72_tei388s | ||
| Lenovo Thinksystem Sr150 | ||
| <3.72_tei388s | ||
| Lenovo Thinksystem Sr158 | ||
| <3.72_tei388s | ||
| Lenovo Thinksystem Sr250 | ||
| <2.60_tgbt42h | ||
| <3.72_tei388s | ||
| Lenovo Thinksystem Sr258 | ||
| <2.60_tgbt42h | ||
| <8.88_cdi3a4a | ||
| Lenovo Thinksystem Sr530 | ||
| <8.88_cdi3a4a | ||
| Lenovo Thinksystem Sr550 | ||
| <8.88_cdi3a4a | ||
| Lenovo Thinksystem Sr570 | ||
| <8.88_cdi3a4a | ||
| Lenovo Thinksystem Sr590 | ||
| Lenovo Thinksystem Sr630 Firmware | <8.88_cdi3a4a | |
| Lenovo Thinksystem Sr630 | ||
| <2.93_afbt30p | ||
| <4.71_d8bt48p | ||
| Lenovo Thinksystem Sr645 | ||
| <4.71_d8bt48p | ||
| <8.88_cdi3a4a | ||
| Lenovo Thinksystem Sr650 | ||
| <2.93_afbt30p | ||
| <4.71_d8bt48p | ||
| Lenovo Thinksystem Sr665 | ||
| <4.71_d8bt48p | ||
| <3.72_tei388s | ||
| Lenovo Thinksystem Sr670 | ||
| <2.60_tgbt42h | ||
| <3.72_tei388s | ||
| Lenovo Thinksystem Sr850 | ||
| <2.60_tgbt42h | ||
| <3.72_tei388s | ||
| Lenovo Thinksystem Sr850p | ||
| <3.72_tei388s | ||
| Lenovo Thinksystem Sr860 | ||
| <2.60_tgbt42h | ||
| <2.75_psi348s | ||
| Lenovo Thinksystem Sr950 | ||
| <3.72_tei388s | ||
| Lenovo Thinksystem St250 | ||
| <2.60_tgbt42h | ||
| <3.72_tei388s | ||
| Lenovo Thinksystem St258 | ||
| <2.60_tgbt42h | ||
| <8.88_cdi3a4a | ||
| Lenovo Thinksystem St550 | ||
| <2.60_tgbt42h | ||
| <2.60_tgbt42h | ||
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- collector/nvd-index
- vendor/lenovo
- canonical/lenovo thinkagile hx1320
- canonical/lenovo thinkagile hx1321
- canonical/lenovo thinkagile hx1520-r
- canonical/lenovo thinkagile hx1521-r
- canonical/lenovo thinkagile hx2320-e
- canonical/lenovo thinkagile hx2321
- canonical/lenovo thinkagile hx3320
- canonical/lenovo thinkagile hx3321
- canonical/lenovo thinkagile hx3375
- canonical/lenovo thinkagile hx3376
- canonical/lenovo thinkagile hx3520-g
- canonical/lenovo thinkagile hx3521-g
- canonical/lenovo thinkagile hx3720
- canonical/lenovo thinkagile hx5520
- canonical/lenovo thinkagile hx5520-c
- canonical/lenovo thinkagile hx5521
- canonical/lenovo thinkagile hx5521-c
- canonical/lenovo thinkagile hx7520
- canonical/lenovo thinkagile hx7521
- canonical/lenovo thinkagile hx7820
- canonical/lenovo thinkagile hx7821
- canonical/lenovo thinkagile mx1020
- canonical/lenovo thinkagile vx2320
- canonical/lenovo thinkagile vx3320
- canonical/lenovo thinkagile vx3520-g
- canonical/lenovo thinkagile vx5520
- canonical/lenovo thinkagile vx7320 n
- canonical/lenovo thinkagile vx7520
- canonical/lenovo thinkagile vx7520 n
- canonical/lenovo thinkstation p920 firmware
- canonical/lenovo thinkstation p920
- canonical/lenovo thinksystem sd530
- canonical/lenovo thinksystem sd650
- canonical/lenovo thinksystem se350
- canonical/lenovo thinksystem sn550
- canonical/lenovo thinksystem sn850
- canonical/lenovo thinksystem sr150
- canonical/lenovo thinksystem sr158
- canonical/lenovo thinksystem sr250
- canonical/lenovo thinksystem sr258
- canonical/lenovo thinksystem sr530
- canonical/lenovo thinksystem sr550
- canonical/lenovo thinksystem sr570
- canonical/lenovo thinksystem sr590
- canonical/lenovo thinksystem sr630 firmware
- canonical/lenovo thinksystem sr630
- canonical/lenovo thinksystem sr645
- canonical/lenovo thinksystem sr650
- canonical/lenovo thinksystem sr665
- canonical/lenovo thinksystem sr670
- canonical/lenovo thinksystem sr850
- canonical/lenovo thinksystem sr850p
- canonical/lenovo thinksystem sr860
- canonical/lenovo thinksystem sr950
- canonical/lenovo thinksystem st250
- canonical/lenovo thinksystem st258
- canonical/lenovo thinksystem st550