CVE-2023-0683 Privilege escalation in XClarity Controller

High 8.3 Published 1 May 2023 Updated 30 Jan 2025

An authenticated read-only user can gain elevated privileges via a crafted API call in Lenovo XClarity Controller.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-0683?

CVE-2023-0683 is a high-severity vulnerability in Lenovo XClarity Controller, published on 1 May 2023. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

A valid, authenticated XCC user with read only access may gain elevated privileges through a specifically crafted API call.

Weakness: CWE-20

Which versions are affected by CVE-2023-0683?

It affects 109 products.

Products include Lenovo Thinkagile Hx1021 Firmware, Lenovo Thinkagile Hx1320 Firmware, Lenovo Thinkagile Hx1321 Firmware, Lenovo Thinkagile Hx1331 Firmware, Lenovo Thinkagile Hx1520-R Firmware, Lenovo Thinkagile Hx1521-R Firmware and 103 more.

How do I fix CVE-2023-0683?

No fix has been published for CVE-2023-0683 yet. Limit exposure of the affected software until one is available.

Is CVE-2023-0683 being exploited?

There is no known exploitation of CVE-2023-0683 in the wild and no public exploit code.

Sources

Also known as GHSA-p2jf-cw3h-mcrc.