CVE-2023-4605 - Vulnerability Details - OpenCVE

A valid authenticated Lenovo XClarity Administrator (LXCA) user can potentially leverage an unauthenticated API endpoint to retrieve system event information.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

No data.

No data.

No data.

References

Link	Providers
https://support.lenovo.com/us/en/product_security/LEN-136592

History

No history.

MITRE

Status: PUBLISHED

Assigner: lenovo

Published: 2024-04-05T20:44:43.105Z

Updated: 2024-08-12T18:32:28.134Z

Reserved: 2023-08-29T15:54:52.890Z

Link: CVE-2023-4605

Vulnrichment

Updated: 2024-08-02T07:31:06.648Z

NVD

Status : Awaiting Analysis

Published: 2024-04-05T21:15:08.003

Modified: 2024-11-21T08:35:31.717

Link: CVE-2023-4605

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-4605", "assignerOrgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b", "state": "PUBLISHED", "assignerShortName": "lenovo", "dateReserved": "2023-08-29T15:54:52.890Z", "datePublished": "2024-04-05T20:44:43.105Z", "dateUpdated": "2024-08-12T18:32:28.134Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "XClarity Administrator", "vendor": "Lenovo ", "versions": [{"lessThan": "3.6.28", "status": "affected", "version": " ", "versionType": "custom"}, {"lessThan": "4.0.24", "status": "affected", "version": " ", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "\n\n<span style=\"background-color: rgb(255, 255, 255);\">A valid authenticated Lenovo XClarity Administrator (LXCA) user can potentially leverage an unauthenticated API endpoint to retrieve system event information.</span>\n\n"}], "value": "\nA valid authenticated Lenovo XClarity Administrator (LXCA) user can potentially leverage an unauthenticated API endpoint to retrieve system event information.\n\n"}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-497", "description": "CWE-497: Exposure of Sensitive System Information to an Unauthorized Control Sphere", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b", "shortName": "lenovo", "dateUpdated": "2024-04-05T20:44:43.105Z"}, "references": [{"url": "https://support.lenovo.com/us/en/product_security/LEN-136592"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "\n\n<p>Update to the Lenovo XClarity Administrator (LXCA) version (or higher) as recommended in the advisory: <a target=\"_blank\" rel=\"nofollow\" href=\"https://support.lenovo.com/us/en/product_security/LEN-136592\">https://support.lenovo.com/us/en/product_security/LEN-136592</a></p><p>Follow general security best practices, such as limiting access to only trusted users within the environment. </p><p>Only grant LXCA remote console/mount privileges to trusted administrative users.</p>"}], "value": "\nUpdate to the Lenovo XClarity Administrator (LXCA) version (or higher) as recommended in the advisory:\u00a0 https://support.lenovo.com/us/en/product_security/LEN-136592 \n\nFollow general security best practices, such as limiting access to only trusted users within the environment. \n\nOnly grant LXCA remote console/mount privileges to trusted administrative users.\n\n"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T07:31:06.648Z"}, "title": "CVE Program Container", "references": [{"url": "https://support.lenovo.com/us/en/product_security/LEN-136592", "tags": ["x_transferred"]}]}, {"affected": [{"vendor": "lenovo", "product": "xclarity_administrator", "cpes": ["cpe:2.3:a:lenovo:xclarity_administrator:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "3.6.28", "versionType": "custom"}, {"version": "0", "status": "affected", "lessThan": "4.0.24", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-08-12T18:31:01.718256Z", "id": "CVE-2023-4605", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-12T18:32:28.134Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://support.lenovo.com/us/en/product_security/LEN-136592", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T07:31:06.648Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-4605", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-08-12T18:31:01.718256Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:lenovo:xclarity_administrator:*:*:*:*:*:*:*:*"], "vendor": "lenovo", "product": "xclarity_administrator", "versions": [{"status": "affected", "version": "0", "lessThan": "3.6.28", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "4.0.24", "versionType": "custom"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-12T18:32:22.408Z"}}], "cna": {"source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Lenovo ", "product": "XClarity Administrator", "versions": [{"status": "affected", "version": " ", "lessThan": "3.6.28", "versionType": "custom"}, {"status": "affected", "version": " ", "lessThan": "4.0.24", "versionType": "custom"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "\nUpdate to the Lenovo XClarity Administrator (LXCA) version (or higher) as recommended in the advisory:\u00a0 https://support.lenovo.com/us/en/product_security/LEN-136592 \n\nFollow general security best practices, such as limiting access to only trusted users within the environment. \n\nOnly grant LXCA remote console/mount privileges to trusted administrative users.\n\n", "supportingMedia": [{"type": "text/html", "value": "\n\n<p>Update to the Lenovo XClarity Administrator (LXCA) version (or higher) as recommended in the advisory: <a target=\"_blank\" rel=\"nofollow\" href=\"https://support.lenovo.com/us/en/product_security/LEN-136592\">https://support.lenovo.com/us/en/product_security/LEN-136592</a></p><p>Follow general security best practices, such as limiting access to only trusted users within the environment. </p><p>Only grant LXCA remote console/mount privileges to trusted administrative users.</p>", "base64": false}]}], "references": [{"url": "https://support.lenovo.com/us/en/product_security/LEN-136592"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "\nA valid authenticated Lenovo XClarity Administrator (LXCA) user can potentially leverage an unauthenticated API endpoint to retrieve system event information.\n\n", "supportingMedia": [{"type": "text/html", "value": "\n\n<span style=\"background-color: rgb(255, 255, 255);\">A valid authenticated Lenovo XClarity Administrator (LXCA) user can potentially leverage an unauthenticated API endpoint to retrieve system event information.</span>\n\n", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-497", "description": "CWE-497: Exposure of Sensitive System Information to an Unauthorized Control Sphere"}]}], "providerMetadata": {"orgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b", "shortName": "lenovo", "dateUpdated": "2024-04-05T20:44:43.105Z"}}}, "cveMetadata": {"cveId": "CVE-2023-4605", "state": "PUBLISHED", "dateUpdated": "2024-08-12T18:32:28.134Z", "dateReserved": "2023-08-29T15:54:52.890Z", "assignerOrgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b", "datePublished": "2024-04-05T20:44:43.105Z", "assignerShortName": "lenovo"}, "dataVersion": "5.1"}