1. Home
  2. CVE Database
  3. CVE-2023-25495
MEDIUM · 4.9

CVE-2023-25495

A valid, authenticated administrative user can query a web interface API to reveal the configured LDAP client password used by XCC to authenticate to an external LDAP server in certain configurations....

Vulnerability Description

A valid, authenticated administrative user can query a web interface API to reveal the configured LDAP client password used by XCC to authenticate to an external LDAP server in certain configurations. There is no exposure where no LDAP client password is configured

CVSS Score

4.9

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
NONE
Availability
NONE

Affected Products

VendorProductVersions
LenovoThinkagile Hx5530 Firmware< 2.93_afbt30p
LenovoThinkagile Hx5530-
LenovoThinkagile Hx7530 Firmware< 2.93_afbt30p
LenovoThinkagile Hx7530-
LenovoThinkagile Vx3331 Firmware< 2.93_afbt30p
LenovoThinkagile Vx3331-
LenovoThinkagile Hx Enclosure Firmware< 3.72_tei388s
LenovoThinkagile Hx Enclosure-
LenovoThinkagile Hx1021 Firmware< 3.72_tei388s
LenovoThinkagile Hx1021-
LenovoThinkagile Hx1320 Firmware< 8.88_cdi3a4a
LenovoThinkagile Hx1320-
LenovoThinkagile Hx1321 Firmware< 8.88_cdi3a4a
LenovoThinkagile Hx1321-
LenovoThinkagile Hx1331 Firmware< 2.93_afbt30p
LenovoThinkagile Hx1331-
LenovoThinkagile Hx1520-R Firmware< 8.88_cdi3a4a
LenovoThinkagile Hx1520-R-
LenovoThinkagile Hx1521-R Firmware< 8.88_cdi3a4a
LenovoThinkagile Hx1521-R-

Related Weaknesses (CWE)

CWE-522

References

FAQ

What is CVE-2023-25495?

CVE-2023-25495 is a vulnerability with a CVSS score of 4.9 (MEDIUM). A valid, authenticated administrative user can query a web interface API to reveal the configured LDAP client password used by XCC to authenticate to an external LDAP server in certain configurations....

How severe is CVE-2023-25495?

CVE-2023-25495 has been rated MEDIUM with a CVSS base score of 4.9/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2023-25495?

Check the references section above for vendor advisories and patch information. Affected products include: Lenovo Thinkagile Hx5530 Firmware, Lenovo Thinkagile Hx5530, Lenovo Thinkagile Hx7530 Firmware, Lenovo Thinkagile Hx7530, Lenovo Thinkagile Vx3331 Firmware.