What is CVE-2021-3956?

CVE-2021-3956 is a medium-severity vulnerability in Lenovo Thinkagile_hx1320, classified under Incorrect Authorization. CVSS score: 4.3/10. Published 2022-05-18.

How severe is CVE-2021-3956?

Medium severity. CVSS v3 base score is 4.3 out of 10.

Auth bypass in Lenovo Thinkagile_hx1320

CVE-2021-3956

A read-only authentication bypass vulnerability was reported in the Third Quarter 2021 release of Lenovo XClarity Controller (XCC) firmware affecting XCC devices configured in LDAP Authentication Only Mode and using an LDAP server that sup…

Vulnerability class: Broken Access Control

EPSS: 0.007 (50.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N.

Affected products

Lenovo Thinkagile_hx1320
Lenovo Thinkagile_hx1321
Lenovo Thinkagile_hx1520-r
Lenovo Thinkagile_hx1521-r
Lenovo Thinkagile_hx2320-e
Lenovo Thinkagile_hx2321
Lenovo Thinkagile_hx3320
Lenovo Thinkagile_hx3321
Lenovo Thinkagile_hx3375
Lenovo Thinkagile_hx3376

Weakness classification (CWE)

CWE-863 — Incorrect Authorization

References

psirt@lenovo.com (x_refsource_MISC, Vendor Advisory)

Frequently asked questions

What is CVE-2021-3956?: CVE-2021-3956 is a medium-severity vulnerability in Lenovo Thinkagile_hx1320, classified under Incorrect Authorization. CVSS score: 4.3/10. Published 2022-05-18.
How severe is CVE-2021-3956?: Medium severity. CVSS v3 base score is 4.3 out of 10.