CVE-2021-3956 Auth bypass in XClarity Controller (XCC)
Unauthenticated attackers can view XCC configuration when LDAP authentication is configured with unauthenticated bind support.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-3956?
CVE-2021-3956 is a medium-severity authentication bypass vulnerability in Lenovo XClarity Controller (XCC), published on 18 May 2022. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A read-only authentication bypass vulnerability was reported in the Third Quarter 2021 release of Lenovo XClarity Controller (XCC) firmware affecting XCC devices configured in LDAP Authentication Only Mode and using an LDAP server that supports “unauthenticated bind”, such as Microsoft Active Directory. An unauthenticated user can gain read-only access to XCC in such a configuration, thereby allowing the XCC device configuration to be viewed but not changed. XCC devices configured to use local authentication, LDAP Authentication + Authorization Mode, or LDAP servers that support only “authenticated bind” and/or “anonymous bind” are not affected.
Weakness: CWE-863
Which versions are affected by CVE-2021-3956?
It affects 1 product.
Products include Lenovo Xclarity Controller.
How do I fix CVE-2021-3956?
No fix has been published for CVE-2021-3956 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2021-3956 being exploited?
There is no known exploitation of CVE-2021-3956 in the wild and no public exploit code.
Other vulnerabilities in Lenovo XClarity Controller (XCC)
Sources
Also known as GHSA-fjvh-mchr-664c.