CVE-2023-34420: OS Command Injection
A valid, authenticated LXCA user with elevated privileges may be able to execute command injections through crafted calls to a specific web API.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
LXCAto a version that resolves this vulnerability.Fixed in 4.0
Event History
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2023-34420.
What is the severity of CVE-2023-34420?
The severity of CVE-2023-34420 is high with a CVSS score of 7.2.
What is the affected software for CVE-2023-34420?
The affected software for CVE-2023-34420 is Lenovo XClarity Administrator up to version 4.0.0.
How can a valid, authenticated LXCA user with elevated privileges exploit CVE-2023-34420?
A valid, authenticated LXCA user with elevated privileges can exploit CVE-2023-34420 by executing command injections through crafted calls to a specific web API.
Is there a fix available for CVE-2023-34420?
Yes, Lenovo has provided a fix for CVE-2023-34420. Please refer to the following link for more information: https://support.lenovo.com/us/en/product_security/LEN-98715