Vulnerability in Lenovo Xclarity Controller
CVE-2022-34888
The Remote Mount feature can potentially be abused by valid, authenticated users to make connections to internal services that may not normally be accessible to users. Internal service access controls, as applicable, remain in effect.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 2.7 (Low). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L.
EPSS exploit prediction
EPSS: 0.004 (32.9th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 33rd percentile — 32.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.004 · newest: 0.004 · change: 0.000
Affected products
- Lenovo Xclarity Controller — versions various
- Lenovo Thinkagile Hx1021
- Lenovo Thinkagile Hx1021 Firmware
- Lenovo Thinkagile Hx1320
- Lenovo Thinkagile Hx1320 Firmware
- Lenovo Thinkagile Hx1321
- Lenovo Thinkagile Hx1321 Firmware
- Lenovo Thinkagile Hx1520-R
- Lenovo Thinkagile Hx1520-R Firmware
- Lenovo Thinkagile Hx1521-R
Weakness classification (CWE)
References
- support.lenovo.com/us/en/product_security/LEN-87734 (Vendor Advisory)
Frequently asked questions
- What is CVE-2022-34888?
- CVE-2022-34888 is a low-severity vulnerability in Lenovo Xclarity Controller, classified under Incomplete List of Disallowed Inputs. CVSS score: 2.7/10. Published 2023-01-30.
- How severe is CVE-2022-34888?
- Low severity. CVSS v3 base score is 2.7 out of 10.