CVE-2023-25495 Information disclosure in XClarity Controller

What is CVE-2023-25495?

CVE-2023-25495 is a medium-severity vulnerability in Lenovo XClarity Controller, published on 28 Apr 2023. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

A valid, authenticated administrative user can query a web interface API to reveal the configured LDAP client password used by XCC to authenticate to an external LDAP server in certain configurations. There is no exposure where no LDAP client password is configured

Weakness: CWE-522

Which versions are affected by CVE-2023-25495?

It affects 109 products.

Products include Lenovo Thinkagile Hx1021 Firmware, Lenovo Thinkagile Hx1320 Firmware, Lenovo Thinkagile Hx1321 Firmware, Lenovo Thinkagile Hx1331 Firmware, Lenovo Thinkagile Hx1520-R Firmware, Lenovo Thinkagile Hx1521-R Firmware and 103 more.

How do I fix CVE-2023-25495?

No fix has been published for CVE-2023-25495 yet. Limit exposure of the affected software until one is available.

Is CVE-2023-25495 being exploited?

There is no known exploitation of CVE-2023-25495 in the wild and no public exploit code.

Other vulnerabilities in Lenovo XClarity Controller

• CVE-2023-0683 Privilege escalation in XClarity Controller High 8.3
• CVE-2023-29057 Privilege escalation in XClarity Controller High 7.3
• CVE-2022-34884 Memory corruption in Lenovo XClarity Controller High 7.2
• CVE-2023-29058 Missing authorization in XClarity Controller Medium 6.4
• CVE-2023-25492 Other in XClarity Controller Medium 6.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-66qf-8j2h-9xmq.