What is CVE-2023-29058?

CVE-2023-29058 is a medium-severity vulnerability in Lenovo Thinkagile_hx1021, classified under Incorrect Default Permissions. CVSS score: 6.4/10. Published 2023-04-28.

How severe is CVE-2023-29058?

Medium severity. CVSS v3 base score is 6.4 out of 10.

Vulnerability in Lenovo Thinkagile_hx1021

CVE-2023-29058

A valid, authenticated XCC user with read-only permissions can modify custom user roles on other user accounts and the user trespass message through the XCC CLI. There is no exposure if SSH is disabled or if there are no users assigned opt…

EPSS: 0.004 (28.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.4 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:H/A:H.

Affected products

Lenovo Thinkagile_hx1021
Lenovo Thinkagile_hx1021_firmware
Lenovo Thinkagile_hx1320
Lenovo Thinkagile_hx1320_firmware
Lenovo Thinkagile_hx1321
Lenovo Thinkagile_hx1321_firmware
Lenovo Thinkagile_hx1331
Lenovo Thinkagile_hx1331_firmware
Lenovo Thinkagile_hx1520-r
Lenovo Thinkagile_hx1520-r_firmware

Weakness classification (CWE)

CWE-276 — Incorrect Default Permissions

References

psirt@lenovo.com (Vendor Advisory)

Frequently asked questions

What is CVE-2023-29058?: CVE-2023-29058 is a medium-severity vulnerability in Lenovo Thinkagile_hx1021, classified under Incorrect Default Permissions. CVSS score: 6.4/10. Published 2023-04-28.
How severe is CVE-2023-29058?: Medium severity. CVSS v3 base score is 6.4 out of 10.