Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2023-4607

An authenticated XCC user can change permissions for any user through a crafted API command.

Security Impact Summary

This vulnerability carries a HIGH severity rating with a CVSS v3.1 score of 7.5, indicating it can be exploited remotely over the network but requires specific conditions to be met without requiring user interaction requiring only low-level privileges . The vulnerability impacts confidentiality (data exposure), integrity (unauthorized modifications), and availability (service disruption) for affected systems. Impacting 231 products from lenovo, from lenovo, from lenovo and 228 others, organizations running these solutions should prioritize assessment and patching.

Historical Context

Reported in 2023, this vulnerability emerged during an era marked by increased sophistication in supply chain attacks, cloud infrastructure vulnerabilities, and software-as-a-service (SaaS) security challenges. Security practices during this period emphasized zero-trust architectures, container security, and API protection.

Published

2023-10-25T18:17:41.560

Last Modified

2024-11-21T08:35:32.027

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 7.5 (HIGH)

Weaknesses

Type: Secondary
CWE-269

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Operating System	lenovo	thinkagile_hx5530_firmware	-	Yes
Hardware	lenovo	thinkagile_hx5530	-	No
Operating System	lenovo	thinkagile_hx7530_firmware	-	Yes
Hardware	lenovo	thinkagile_hx7530	-	No
Operating System	lenovo	thinkagile_vx3331_firmware	-	Yes
Hardware	lenovo	thinkagile_vx3331	-	No
Operating System	lenovo	thinkagile_hx1331_firmware	-	Yes
Hardware	lenovo	thinkagile_hx1331	-	No
Operating System	lenovo	thinkagile_hx2330_firmware	-	Yes
Hardware	lenovo	thinkagile_hx2330	-	No
Operating System	lenovo	thinkagile_hx2331_firmware	-	Yes
Hardware	lenovo	thinkagile_hx2331	-	No
Operating System	lenovo	thinkagile_hx3330_firmware	-	Yes
Hardware	lenovo	thinkagile_hx3330	-	No
Operating System	lenovo	thinkagile_hx3331_firmware	-	Yes
Hardware	lenovo	thinkagile_hx3331	-	No
Operating System	lenovo	thinkagile_hx3331_firmware	-	Yes
Hardware	lenovo	thinkagile_hx3331	-	No
Operating System	lenovo	thinkagile_hx3375_firmware	-	Yes
Hardware	lenovo	thinkagile_hx3375	-	No
Operating System	lenovo	thinkagile_hx3376_firmware	-	Yes
Hardware	lenovo	thinkagile_hx3376	-	No
Operating System	lenovo	thinkagile_hx5531_firmware	-	Yes
Hardware	lenovo	thinkagile_hx5531	-	No
Operating System	lenovo	thinkagile_hx7530_firmware	-	Yes
Hardware	lenovo	thinkagile_hx7530	-	No
Operating System	lenovo	thinkagile_hx7531_firmware	-	Yes
Hardware	lenovo	thinkagile_hx7531	-	No
Operating System	lenovo	thinkagile_hx7531_firmware	-	Yes
Hardware	lenovo	thinkagile_hx7531	-	No
Operating System	lenovo	thinkagile_mx3330-f_all-flash_firmware	-	Yes
Hardware	lenovo	thinkagile_mx3330-f_all-flash	-	No
Operating System	lenovo	thinkagile_mx3330-h_hybrid_firmware	-	Yes
Hardware	lenovo	thinkagile_mx3330-h_hybrid	-	No
Operating System	lenovo	thinkagile_mx3331-f_all-flash_firmware	-	Yes
Hardware	lenovo	thinkagile_mx3331-f_all-flash	-	No
Operating System	lenovo	thinkagile_mx3331-h_hybrid_firmware	-	Yes
Hardware	lenovo	thinkagile_mx3331-h_hybrid	-	No
Operating System	lenovo	thinkagile_mx3530_f_all_flash_firmware	-	Yes
Hardware	lenovo	thinkagile_mx3530_f_all_flash	-	No
Operating System	lenovo	thinkagile_mx3530-h_hybrid_firmware	-	Yes
Hardware	lenovo	thinkagile_mx3530-h_hybrid	-	No
Operating System	lenovo	thinkagile_mx3531_h_hybrid_firmware	-	Yes
Hardware	lenovo	thinkagile_mx3531_h_hybrid	-	No
Operating System	lenovo	thinkagile_mx3531-f_all-flash_firmware	-	Yes
Hardware	lenovo	thinkagile_mx3531-f_all-flash	-	No
Operating System	lenovo	thinkagile_vx2330_firmware	-	Yes
Hardware	lenovo	thinkagile_vx2330	-	No
Operating System	lenovo	thinkagile_vx3330_firmware	-	Yes
Hardware	lenovo	thinkagile_vx3330	-	No
Operating System	lenovo	thinkagile_vx3530-g_firmware	-	Yes
Hardware	lenovo	thinkagile_vx3530-g	-	No
Operating System	lenovo	thinkagile_vx5530_firmware	-	Yes
Hardware	lenovo	thinkagile_vx5530	-	No
Operating System	lenovo	thinkagile_vx7330_firmware	-	Yes
Hardware	lenovo	thinkagile_vx7330	-	No
Operating System	lenovo	thinkagile_vx7530_firmware	-	Yes
Hardware	lenovo	thinkagile_vx7530	-	No
Operating System	lenovo	thinkagile_vx7531_firmware	-	Yes
Hardware	lenovo	thinkagile_vx7531	-	No
Operating System	lenovo	thinksystem_sd630_v2_firmware	-	Yes
Hardware	lenovo	thinksystem_sd630_v2	-	No
Operating System	lenovo	thinksystem_sd650_v2_firmware	-	Yes
Hardware	lenovo	thinksystem_sd650_v2	-	No
Operating System	lenovo	thinksystem_sd650_v3_firmware	-	Yes
Operating System	lenovo	thinksystem_sd650-n_v2_firmware	-	Yes
Hardware	lenovo	thinksystem_sd650-n_v2	-	No
Operating System	lenovo	thinksystem_sd665_v3_firmware	-	Yes
Operating System	lenovo	thinksystem_sn550_v2_firmware	-	Yes
Hardware	lenovo	thinksystem_sn550_v2	-	No
Operating System	lenovo	thinksystem_sr250_firmware	-	Yes
Hardware	lenovo	thinksystem_sr250_v2	-	No
Operating System	lenovo	thinksystem_sr258_v2_firmware	-	Yes
Hardware	lenovo	thinksystem_sr258_v2	-	No
Operating System	lenovo	thinksystem_sr630_v2_firmware	-	Yes
Hardware	lenovo	thinksystem_sr630_v2	-	No
Operating System	lenovo	thinksystem_sr630_v3_firmware	-	Yes
Operating System	lenovo	thinksystem_sr635_v3_firmware	-	Yes
Operating System	lenovo	thinksystem_sr645_firmware	-	Yes
Hardware	lenovo	thinksystem_sr645	-	No
Operating System	lenovo	thinksystem_sr645_v3_firmware	-	Yes
Hardware	lenovo	thinksystem_sr645_v3	-	No
Operating System	lenovo	thinksystem_sr650_v2_firmware	-	Yes
Hardware	lenovo	thinksystem_sr650_v2	-	No
Operating System	lenovo	thinksystem_sr650_v3_firmware	-	Yes
Operating System	lenovo	thinksystem_sr655_v3_firmware	-	Yes
Operating System	lenovo	thinksystem_sr665_firmware	-	Yes
Hardware	lenovo	thinksystem_sr665	-	No
Operating System	lenovo	thinksystem_sr665_v3_firmware	-	Yes
Operating System	lenovo	thinksystem_sr670_firmware	-	Yes
Hardware	lenovo	thinksystem_sr670	-	No
Operating System	lenovo	thinksystem_sr670_v2_firmware	-	Yes
Hardware	lenovo	thinksystem_sr670_v2	-	No
Operating System	lenovo	thinksystem_sr675_v3_firmware	-	Yes
Operating System	lenovo	thinksystem_sr850_v2_firmware	-	Yes
Hardware	lenovo	thinksystem_sr850_v2	-	No
Operating System	lenovo	thinksystem_sr850_v2_firmware	-	Yes
Hardware	lenovo	thinksystem_sr850_v2	-	No
Operating System	lenovo	thinksystem_sr850_v3_firmware	-	Yes
Operating System	lenovo	thinksystem_sr860_v2_firmware	-	Yes
Hardware	lenovo	thinksystem_sr860_v2	-	No
Operating System	lenovo	thinksystem_sr860_v2_firmware	-	Yes
Hardware	lenovo	thinksystem_sr860_v2	-	No
Operating System	lenovo	thinksystem_sr860_v3_firmware	-	Yes
Operating System	lenovo	thinksystem_st250_v2_firmware	-	Yes
Hardware	lenovo	thinksystem_st250_v2	-	No
Operating System	lenovo	thinksystem_st258_v2_firmware	-	Yes
Hardware	lenovo	thinksystem_st258_v2	-	No
Operating System	lenovo	thinksystem_st650_v2_firmware	-	Yes
Hardware	lenovo	thinksystem_st650_v2	-	No
Operating System	lenovo	thinksystem_st650_v3_firmware	-	Yes
Operating System	lenovo	thinksystem_st658_v2_firmware	-	Yes
Hardware	lenovo	thinksystem_st658_v2	-	No
Operating System	lenovo	thinksystem_st658_v3_firmware	-	Yes
Operating System	lenovo	thinkagile_hx_enclosure_firmware	-	Yes
Hardware	lenovo	thinkagile_hx_enclosure	-	No
Operating System	lenovo	thinkagile_hx1021_edg_firmware	-	Yes
Hardware	lenovo	thinkagile_hx1021_edg	-	No
Operating System	lenovo	thinkagile_hx1320_firmware	-	Yes
Hardware	lenovo	thinkagile_hx1320	-	No
Operating System	lenovo	thinkagile_hx1321_firmware	-	Yes
Hardware	lenovo	thinkagile_hx1321	-	No
Operating System	lenovo	thinkagile_hx1520-r_firmware	-	Yes
Hardware	lenovo	thinkagile_hx1520-r	-	No
Operating System	lenovo	thinkagile_hx1521-r_firmware	-	Yes
Hardware	lenovo	thinkagile_hx1521-r	-	No
Operating System	lenovo	thinkagile_hx2320-e_firmware	-	Yes
Hardware	lenovo	thinkagile_hx2320-e	-	No
Operating System	lenovo	thinkagile_hx2321_firmware	-	Yes
Hardware	lenovo	thinkagile_hx2321	-	No
Operating System	lenovo	thinkagile_hx2720-e_firmware	-	Yes
Hardware	lenovo	thinkagile_hx2720-e	-	No
Operating System	lenovo	thinkagile_hx3320_firmware	-	Yes
Hardware	lenovo	thinkagile_hx3320	-	No
Operating System	lenovo	thinkagile_hx3321_firmware	-	Yes
Hardware	lenovo	thinkagile_hx3321	-	No
Operating System	lenovo	thinkagile_hx3520-g_firmware	-	Yes
Hardware	lenovo	thinkagile_hx3520-g	-	No
Operating System	lenovo	thinkagile_hx3521-g_firmware	-	Yes
Hardware	lenovo	thinkagile_hx3521-g	-	No
Operating System	lenovo	thinkagile_hx3720_firmware	-	Yes
Hardware	lenovo	thinkagile_hx3720	-	No
Operating System	lenovo	thinkagile_hx3721_firmware	-	Yes
Hardware	lenovo	thinkagile_hx3721	-	No
Operating System	lenovo	thinkagile_hx5520_firmware	-	Yes
Hardware	lenovo	thinkagile_hx5520	-	No
Operating System	lenovo	thinkagile_hx5520-c_firmware	-	Yes
Hardware	lenovo	thinkagile_hx5520-c	-	No
Operating System	lenovo	thinkagile_hx5521_firmware	-	Yes
Hardware	lenovo	thinkagile_hx5521	-	No
Operating System	lenovo	thinkagile_hx5521-c_firmware	-	Yes
Hardware	lenovo	thinkagile_hx5521-c	-	No
Operating System	lenovo	thinkagile_hx7520_firmware	-	Yes
Hardware	lenovo	thinkagile_hx7520	-	No
Operating System	lenovo	thinkagile_hx7521_firmware	-	Yes
Hardware	lenovo	thinkagile_hx7521	-	No
Operating System	lenovo	thinkagile_hx7820_firmware	-	Yes
Hardware	lenovo	thinkagile_hx7820	-	No
Operating System	lenovo	thinkagile_hx7821_firmware	-	Yes
Hardware	lenovo	thinkagile_hx7821	-	No
Operating System	lenovo	thinkagile_mx_edge-_mx1020__firmware	-	Yes
Hardware	lenovo	thinkagile_mx_edge-_mx1020_	-	No
Hardware	lenovo	thinkagile_mx630_v3_firmware	-	Yes
Hardware	lenovo	thinkagile_mx630_v3_intergrated_system_firmware	-	Yes
Hardware	lenovo	thinkagile_mx650_v3_firmware	-	Yes
Hardware	lenovo	thinkagile_mx650_v3_intergrated_system_firmware	-	Yes
Operating System	lenovo	thinkagile_mx1021_on_se350_firmware	-	Yes
Hardware	lenovo	thinkagile_mx1021_on_se350	-	No
Operating System	lenovo	thinkagile_mx1021_on_se350_firmware	-	Yes
Hardware	lenovo	thinkagile_mx1021_on_se350	-	No
Operating System	lenovo	thinkagile_vx_1se_firmware	-	Yes
Hardware	lenovo	thinkagile_vx_1se	-	No
Operating System	lenovo	thinkagile_vx_2u4n_firmware	-	Yes
Hardware	lenovo	thinkagile_vx_2u4n	-	No
Operating System	lenovo	thinkagile_vx_4u_firmware	-	Yes
Hardware	lenovo	thinkagile_vx_4u	-	No
Operating System	lenovo	thinkagile_vx1320_firmware	-	Yes
Hardware	lenovo	thinkagile_vx1320	-	No
Operating System	lenovo	thinkagile_vx2320_firmware	-	Yes
Hardware	lenovo	thinkagile_vx2320	-	No
Operating System	lenovo	thinkagile_vx3320_firmware	-	Yes
Hardware	lenovo	thinkagile_vx3320	-	No
Operating System	lenovo	thinkagile_vx3520-g_firmware	-	Yes
Hardware	lenovo	thinkagile_vx3520-g	-	No
Operating System	lenovo	thinkagile_vx3720_firmware	-	Yes
Hardware	lenovo	thinkagile_vx3720	-	No
Operating System	lenovo	thinkagile_vx5520_firmware	-	Yes
Hardware	lenovo	thinkagile_vx5520	-	No
Operating System	lenovo	thinkagile_vx7320_n_firmware	-	Yes
Hardware	lenovo	thinkagile_vx7320_n	-	No
Operating System	lenovo	thinkagile_vx7520_firmware	-	Yes
Hardware	lenovo	thinkagile_vx7520	-	No
Operating System	lenovo	thinkagile_vx7520_n_firmware	-	Yes
Hardware	lenovo	thinkagile_vx7520_n	-	No
Operating System	lenovo	thinkagile_vx7820_firmware	-	Yes
Hardware	lenovo	thinkagile_vx7820	-	No
Operating System	lenovo	thinkedge_se450__firmware	-	Yes
Hardware	lenovo	thinkedge_se450	-	No
Operating System	lenovo	thinksystem_sd530_firmware	-	Yes
Hardware	lenovo	thinksystem_sd530	-	No
Operating System	lenovo	thinksystem_sd650_dwc_dual_node_tray_firmware	-	Yes
Hardware	lenovo	thinksystem_sd650_dwc_dual_node_tray	-	No
Operating System	lenovo	thinksystem_sd650_dual_node_tray_firmware	-	Yes
Hardware	lenovo	thinksystem_sd650_dual_node_tray	-	No
Operating System	lenovo	thinksystem_se350_firmware	-	Yes
Hardware	lenovo	thinksystem_se350	-	No
Operating System	lenovo	thinksystem_se350_firmware	-	Yes
Hardware	lenovo	thinksystem_se350	-	No
Operating System	lenovo	thinksystem_sn550_firmware	-	Yes
Hardware	lenovo	thinksystem_sn550	-	No
Operating System	lenovo	thinksystem_sn550_firmware	-	Yes
Hardware	lenovo	thinksystem_sn550	-	No
Operating System	lenovo	thinksystem_sn850_firmware	-	Yes
Hardware	lenovo	thinksystem_sn850	-	No
Operating System	lenovo	thinksystem_sn850_firmware	-	Yes
Hardware	lenovo	thinksystem_sn850	-	No
Operating System	lenovo	thinksystem_sr150_firmware	-	Yes
Hardware	lenovo	thinksystem_sr150	-	No
Operating System	lenovo	thinksystem_sr158_firmware	-	Yes
Hardware	lenovo	thinksystem_sr158	-	No
Operating System	lenovo	thinksystem_sr250_firmware	-	Yes
Hardware	lenovo	thinksystem_sr250	-	No
Operating System	lenovo	thinksystem_sr258_firmware	-	Yes
Hardware	lenovo	thinksystem_sr258	-	No
Operating System	lenovo	thinksystem_sr530_firmware	-	Yes
Hardware	lenovo	thinksystem_sr530	-	No
Operating System	lenovo	thinksystem_sr550_firmware	-	Yes
Hardware	lenovo	thinksystem_sr550	-	No
Operating System	lenovo	thinksystem_sr570_firmware	-	Yes
Hardware	lenovo	thinksystem_sr570	-	No
Operating System	lenovo	thinksystem_sr590_firmware	-	Yes
Hardware	lenovo	thinkserver_sr590	-	No
Operating System	lenovo	thinksystem_sr630_firmware	-	Yes
Hardware	lenovo	thinksystem_sr630	-	No
Operating System	lenovo	thinksystem_sr650_firmware	-	Yes
Hardware	lenovo	thinksystem_sr650	-	No
Operating System	lenovo	thinksystem_sr670_firmware	-	Yes
Hardware	lenovo	thinksystem_sr670	-	No
Operating System	lenovo	thinksystem_sr850_firmware	-	Yes
Hardware	lenovo	thinksystem_sr850	-	No
Operating System	lenovo	thinksystem_sr850_firmware	-	Yes
Hardware	lenovo	thinksystem_sr850	-	No
Operating System	lenovo	thinksystem_sr850p_firmware	-	Yes
Hardware	lenovo	thinksystem_sr850p	-	No
Operating System	lenovo	thinksystem_sr860_firmware	-	Yes
Hardware	lenovo	thinksystem_sr860	-	No
Operating System	lenovo	thinksystem_sr860_firmware	-	Yes
Hardware	lenovo	thinksystem_sr860	-	No
Operating System	lenovo	thinksystem_sr950_firmware	-	Yes
Hardware	lenovo	thinksystem_sr950	-	No
Operating System	lenovo	thinksystem_st250_firmware	-	Yes
Hardware	lenovo	thinksystem_st250	-	No
Operating System	lenovo	thinksystem_st258_firmware	-	Yes
Hardware	lenovo	thinksystem_st258	-	No
Operating System	lenovo	thinksystem_st550_firmware	-	Yes
Hardware	lenovo	thinksystem_st550	-	No

References

https://support.lenovo.com/us/en/product_security/LEN-140960 Vendor Advisory ([email protected])
https://support.lenovo.com/us/en/product_security/LEN-140960 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)

How SecUtils Interprets This CVE

SecUtils normalizes and enriches National Vulnerability Database (NVD) records by standardizing vendor and product identifiers, aggregating vulnerability metadata from both NVD and MITRE sources, and providing structured context for security teams. For lenovo's affected products, we extract Common Platform Enumeration (CPE) data, Common Weakness Enumeration (CWE) classifications, CVSS severity metrics, and reference data to enable rapid vulnerability prioritization and asset correlation. This record contains no exploit code, proof-of-concept instructions, or attack methodologies—only defensive intelligence necessary for patch management, risk assessment, and security operations.