CVE-2023-4608 SQL injection in Lenovo XClarity Controller (XCC)
Authenticated privileged users can execute blind SQL injection via crafted API commands on Lenovo XClarity Controller.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-4608?
CVE-2023-4608 is a medium-severity SQL injection vulnerability in Lenovo XClarity Controller (XCC), published on 24 Oct 2023. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
An authenticated XCC user with elevated privileges can perform blind SQL injection in limited cases through a crafted API command.
This affects ThinkSystem v2 and v3 servers with XCC; ThinkSystem v1 servers are not affected.
Weakness: CWE-89
Which versions are affected by CVE-2023-4608?
It affects 58 products.
Products include Lenovo Thinkagile Hx1331 Firmware, Lenovo Thinkagile Hx2330 Firmware, Lenovo Thinkagile Hx2331 Firmware, Lenovo Thinkagile Hx3330 Firmware, Lenovo Thinkagile Hx3331 Firmware, Lenovo Thinkagile Hx3375 Firmware and 52 more.
How do I fix CVE-2023-4608?
No fix has been published for CVE-2023-4608 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2023-4608 being exploited?
There is no known exploitation of CVE-2023-4608 in the wild and no public exploit code.
Other vulnerabilities in Lenovo XClarity Controller (XCC)
Sources
Also known as GHSA-96gf-qq25-2c24.