CVE-2023-4606 Missing authorization in Lenovo XClarity Controller (XCC)
A read-only authenticated user can change another user's password via a crafted API command, enabling privilege escalation and account takeover.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-4606?
CVE-2023-4606 is a high-severity missing authorization vulnerability in Lenovo XClarity Controller (XCC), published on 24 Oct 2023. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
An authenticated XCC user with Read-Only permission can change a different user’s password through a crafted API command.
This affects ThinkSystem v2 and v3 servers with XCC; ThinkSystem v1 servers are not affected.
Weakness: CWE-862
Which versions are affected by CVE-2023-4606?
It affects 58 products.
Products include Lenovo Thinkagile Hx1331 Firmware, Lenovo Thinkagile Hx2330 Firmware, Lenovo Thinkagile Hx2331 Firmware, Lenovo Thinkagile Hx3330 Firmware, Lenovo Thinkagile Hx3331 Firmware, Lenovo Thinkagile Hx3375 Firmware and 52 more.
How do I fix CVE-2023-4606?
No fix has been published for CVE-2023-4606 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2023-4606 being exploited?
There is no known exploitation of CVE-2023-4606 in the wild and no public exploit code.
Other vulnerabilities in Lenovo XClarity Controller (XCC)
Sources
Also known as GHSA-fm9p-5c8h-mw8h.