Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2021-3956

A read-only authentication bypass vulnerability was reported in the Third Quarter 2021 release of Lenovo XClarity Controller (XCC) firmware affecting XCC devices configured in LDAP Authentication Only Mode and using an LDAP server that supports “unauthenticated bind”, such as Microsoft Active Directory. An unauthenticated user can gain read-only access to XCC in such a configuration, thereby allowing the XCC device configuration to be viewed but not changed. XCC devices configured to use local authentication, LDAP Authentication + Authorization Mode, or LDAP servers that support only “authenticated bind” and/or “anonymous bind” are not affected.

Published

2022-05-18T16:15:08.063

Last Modified

2024-11-21T06:23:13.527

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 4.3 (MEDIUM)

CVSSv2 Vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

  • Access Vector: NETWORK
  • Access Complexity: MEDIUM
  • Authentication: NONE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: NONE
  • Availability Impact: NONE
Exploitability Score

8.6

Impact Score

2.9

Weaknesses
  • Type: Secondary
    CWE-863
  • Type: Primary
    CWE-863
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application lenovo xclarity_controller < 7.22_cdi382o Yes
Hardware lenovo thinkagile_hx1320 - No
Hardware lenovo thinkagile_hx1321 - No
Hardware lenovo thinkagile_hx1520-r - No
Hardware lenovo thinkagile_hx1521-r - No
Hardware lenovo thinkagile_hx2320-e - No
Hardware lenovo thinkagile_hx2321 - No
Hardware lenovo thinkagile_hx3320 - No
Hardware lenovo thinkagile_hx3321 - No
Hardware lenovo thinkagile_hx3375 - No
Hardware lenovo thinkagile_hx3376 - No
Hardware lenovo thinkagile_hx3520-g - No
Hardware lenovo thinkagile_hx3521-g - No
Hardware lenovo thinkagile_hx5520 - No
Hardware lenovo thinkagile_hx5520-c - No
Hardware lenovo thinkagile_hx5521 - No
Hardware lenovo thinkagile_hx5521-c - No
Hardware lenovo thinkagile_hx7520 - No
Hardware lenovo thinkagile_hx7521 - No
Hardware lenovo thinkagile_vx2320 - No
Hardware lenovo thinkagile_vx3320 - No
Hardware lenovo thinkagile_vx3520-g - No
Hardware lenovo thinkagile_vx5520 - No
Hardware lenovo thinkagile_vx7320_n - No
Hardware lenovo thinkagile_vx7520 - No
Hardware lenovo thinkagile_vx7520_n - No
Hardware lenovo thinkstation_p920 - No
Hardware lenovo thinksystem_sr530 - No
Hardware lenovo thinksystem_sr550 - No
Hardware lenovo thinksystem_sr570 - No
Hardware lenovo thinksystem_sr590 - No
Hardware lenovo thinksystem_sr630 - No
Hardware lenovo thinksystem_sr645 - No
Hardware lenovo thinksystem_sr650 - No
Hardware lenovo thinksystem_sr665 - No
Hardware lenovo thinksystem_st550 - No
Application lenovo xclarity_controller < 2.32_psi342n Yes
Hardware lenovo thinkagile_hx7820 - No
Hardware lenovo thinkagile_hx7821 - No
Hardware lenovo thinksystem_sr950 - No
Application lenovo xclarity_controller < 3.41_tei382m Yes
Hardware lenovo thinkagile_mx1021 - No
Hardware lenovo thinksystem_se350 - No
Application lenovo xclarity_controller < 4.83_tei3c0n Yes
Hardware lenovo thinksystem_sd650 - No
Hardware lenovo thinksystem_sn550 - No
Hardware lenovo thinksystem_sn850 - No
Hardware lenovo thinksystem_sr850 - No
Hardware lenovo thinksystem_sr860 - No
Application lenovo xclarity_controller < 1.51_tgbt24l Yes
Hardware lenovo thinksystem_sr850 2.0 No
Hardware lenovo thinksystem_sr860 2.0 No
References