What is CVE-2023-25495?

CVE-2023-25495 is a medium-severity vulnerability in Lenovo Thinkagile_hx1021, classified under Insufficiently Protected Credentials. CVSS score: 4.9/10. Published 2023-04-28.

How severe is CVE-2023-25495?

Medium severity. CVSS v3 base score is 4.9 out of 10.

Vulnerability in Lenovo Thinkagile_hx1021

CVE-2023-25495

A valid, authenticated administrative user can query a web interface API to reveal the configured LDAP client password used by XCC to authenticate to an external LDAP server in certain configurations. There is no exposure where no LDAP cl…

EPSS: 0.006 (43.3th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 4.9 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N.

Affected products

Lenovo Thinkagile_hx1021
Lenovo Thinkagile_hx1021_firmware
Lenovo Thinkagile_hx1320
Lenovo Thinkagile_hx1320_firmware
Lenovo Thinkagile_hx1321
Lenovo Thinkagile_hx1321_firmware
Lenovo Thinkagile_hx1331
Lenovo Thinkagile_hx1331_firmware
Lenovo Thinkagile_hx1520-r
Lenovo Thinkagile_hx1520-r_firmware

Weakness classification (CWE)

CWE-522 — Insufficiently Protected Credentials

References

psirt@lenovo.com (Vendor Advisory)

Frequently asked questions

What is CVE-2023-25495?: CVE-2023-25495 is a medium-severity vulnerability in Lenovo Thinkagile_hx1021, classified under Insufficiently Protected Credentials. CVSS score: 4.9/10. Published 2023-04-28.
How severe is CVE-2023-25495?: Medium severity. CVSS v3 base score is 4.9 out of 10.