CVEvulnerability

CVE-2023-4608

7.2 HIGH Published 2023-10-25 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2023-10-25
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
4.1 MEDIUM — CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L
CVSS 3.1 ([email protected])
7.2 HIGH — CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-89

Description

An authenticated XCC user with elevated privileges can perform blind SQL injection in limited cases through a crafted API command.  This affects ThinkSystem v2 and v3 servers with XCC; ThinkSystem v1 servers are not affected.

Affected configurations

• lenovo thinkagile hx5530 firmware • lenovo thinkagile hx7530 firmware • lenovo thinkagile vx3331 firmware • lenovo thinkagile hx1331 firmware • lenovo thinkagile hx2330 firmware • lenovo thinkagile hx2331 firmware • lenovo thinkagile hx3330 firmware • lenovo thinkagile hx3331 firmware • lenovo thinkagile hx3375 firmware • lenovo thinkagile hx3376 firmware • lenovo thinkagile hx5531 firmware • lenovo thinkagile hx7531 firmware • lenovo thinkagile mx3330-f all-flash firmware • lenovo thinkagile mx3330-h hybrid firmware • lenovo thinkagile mx3331-f all-flash firmware • lenovo thinkagile mx3331-h hybrid firmware • lenovo thinkagile mx3530 f all flash firmware • lenovo thinkagile mx3530-h hybrid firmware • lenovo thinkagile mx3531 h hybrid firmware • lenovo thinkagile mx3531-f all-flash firmware • lenovo thinkagile vx2330 firmware • lenovo thinkagile vx3330 firmware • lenovo thinkagile vx3530-g firmware • lenovo thinkagile vx5530 firmware • lenovo thinkagile vx7330 firmware • lenovo thinkagile vx7530 firmware • lenovo thinkagile vx7531 firmware • lenovo thinksystem sd630 v2 firmware • lenovo thinksystem sd650 v2 firmware • lenovo thinksystem sd650 v3 firmware • lenovo thinksystem sd650-n v2 firmware • lenovo thinksystem sd665 v3 firmware • lenovo thinksystem sn550 v2 firmware • lenovo thinksystem sr250 firmware • lenovo thinksystem sr258 v2 firmware • lenovo thinksystem sr630 v2 firmware • lenovo thinksystem sr630 v3 firmware • lenovo thinksystem sr635 v3 firmware • lenovo thinksystem sr645 firmware • lenovo thinksystem sr645 v3 firmware • lenovo thinksystem sr650 v2 firmware • lenovo thinksystem sr650 v3 firmware • lenovo thinksystem sr655 v3 firmware • lenovo thinksystem sr665 firmware • lenovo thinksystem sr665 v3 firmware • lenovo thinksystem sr670 firmware • lenovo thinksystem sr670 v2 firmware • lenovo thinksystem sr675 v3 firmware • lenovo thinksystem sr850 v2 firmware • lenovo thinksystem sr850 v3 firmware • lenovo thinksystem sr860 v2 firmware • lenovo thinksystem sr860 v3 firmware • lenovo thinksystem st250 v2 firmware • lenovo thinksystem st258 v2 firmware • lenovo thinksystem st650 v2 firmware • lenovo thinksystem st650 v3 firmware • lenovo thinksystem st658 v2 firmware • lenovo thinksystem st658 v3 firmware

Related

Weakness · CWE (1)

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References