Vulnerability in Lenovo Xclarity Controller
CVE-2022-34888
The Remote Mount feature can potentially be abused by valid, authenticated users to make connections to internal services that may not normally be accessible to users. Internal service access controls, as applicable, remain in effect.
EPSS: 0.004 (33.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 2.7 (Low). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L.
Affected products
- Lenovo Xclarity Controller — versions various
- Lenovo Thinkagile_hx1021
- Lenovo Thinkagile_hx1021_firmware
- Lenovo Thinkagile_hx1320
- Lenovo Thinkagile_hx1320_firmware
- Lenovo Thinkagile_hx1321
- Lenovo Thinkagile_hx1321_firmware
- Lenovo Thinkagile_hx1520-r
- Lenovo Thinkagile_hx1520-r_firmware
- Lenovo Thinkagile_hx1521-r
Weakness classification (CWE)
References
- psirt@lenovo.com (Vendor Advisory)
Frequently asked questions
- What is CVE-2022-34888?
- CVE-2022-34888 is a low-severity vulnerability in Lenovo Xclarity Controller, classified under Incomplete List of Disallowed Inputs. CVSS score: 2.7/10. Published 2023-01-30.
- How severe is CVE-2022-34888?
- Low severity. CVSS v3 base score is 2.7 out of 10.