Lenovo Thinksystem_sr670_v2_firmware
13 CVEs affecting Lenovo Thinksystem_sr670_v2_firmware. Latest disclosed: 2024-02-16. Critical: 0, High: 5.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-0683 | High | 8.3 | 2023-05-01 | A valid, authenticated XCC user with read only access may gain elevated privileges through a specifically crafted API call. |
CVE-2023-4606 | High | 8.1 | 2023-10-25 | An authenticated XCC user with Read-Only permission can change a different user’s password through a crafted API command. This affects ThinkSystem v2 and v3… |
CVE-2023-4607 | High | 7.5 | 2023-10-25 | An authenticated XCC user can change permissions for any user through a crafted API command. |
CVE-2023-29057 | High | 7.3 | 2023-04-28 | A valid XCC user's local account permissions overrides their active directory permissions under specific configurations. This could lead to a privilege escalat… |
CVE-2022-34884 | High | 7.2 | 2023-01-30 | A buffer overflow exists in the Remote Presence subsystem which can potentially allow valid, authenticated users to cause a recoverable subsystem denial of ser… |
CVE-2023-29058 | Medium | 6.4 | 2023-04-28 | A valid, authenticated XCC user with read-only permissions can modify custom user roles on other user accounts and the user trespass message through the XCC CL… |
CVE-2023-25492 | Medium | 6.3 | 2023-05-01 | A valid, authenticated user may be able to trigger a denial of service of the XCC web user interface or other undefined behavior through a format string inject… |
CVE-2023-29056 | Medium | 5.3 | 2023-04-28 | A valid LDAP user, under specific conditions, will default to read-only permissions when authenticating into XCC. To be vulnerable, XCC must be configured to u… |
CVE-2023-25495 | Medium | 4.9 | 2023-04-28 | A valid, authenticated administrative user can query a web interface API to reveal the configured LDAP client password used by XCC to authenticate to an extern… |
CVE-2022-40134 | Medium | 4.4 | 2023-01-30 | An information leak vulnerability in the SMI Set BIOS Password SMI Handler in some Lenovo models may allow an attacker with local access and elevated privilege… |
CVE-2023-4608 | Medium | 4.1 | 2023-10-25 | An authenticated XCC user with elevated privileges can perform blind SQL injection in limited cases through a crafted API command. This affects ThinkSystem v… |
CVE-2022-34888 | Low | 2.7 | 2023-01-30 | The Remote Mount feature can potentially be abused by valid, authenticated users to make connections to internal services that may not normally be accessible t… |
CVE-2024-23591 | Low | 2.0 | 2024-02-16 | ThinkSystem SR670V2 servers manufactured from approximately June 2021 to July 2023 were left in Manufacturing Mode which could allow an attacker with privile… |