CVE-2023-29058

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

A valid, authenticated XCC user with read-only permissions can modify custom user roles on other user accounts and the user trespass message through the XCC CLI. There is no exposure if SSH is disabled or if there are no users assigned optional read-only permissions.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-276

Affected software

Vendor	Product	Versions
Lenovo	XClarity Controller	Refer to Mitigation strategy section in LEN-118321

References

https://support.lenovo.com/us/en/product_security/LEN-118321Vendor Advisory
https://support.lenovo.com/us/en/product_security/LEN-118321Vendor Advisory

Timeline

Published: Apr 28, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-290597.83CX DesktopApp through 18.12.416 has embedded malicious code, as exploited in the wild in March 2023. This affects versions 18.12.407 and 18 CVE-2023-29066.5Due to a failure in validating the length provided by an attacker-crafted CP2179 packet, Wireshark versions 2.0.0 through 4.0.7 is susceptib CVE-2023-290605.7The FACSChorus workstation operating system does not restrict what devices can interact with its USB ports. If exploited, a threat actor wit CVE-2023-290615.2There is no BIOS password on the FACSChorus workstation. A threat actor with physical access to the workstation can potentially exploit this CVE-2023-290623.8The Operating System hosting the FACSChorus application is configured to allow transmission of hashed user credentials upon user action with CVE-2023-290632.4The FACSChorus workstation does not prevent physical access to its PCI express (PCIe) slots, which could allow a threat actor to insert a PC CVE-2023-290644.3The FACSChorus software contains sensitive information stored in plaintext. A threat actor could gain hardcoded secrets used by the applicat CVE-2023-290654.3The FACSChorus software database can be accessed directly with the privileges of the currently logged-in user. A threat actor with physical CVE-2023-290663.5The FACSChorus software does not properly assign data access privileges for operating system user accounts. A non-administrative OS account CVE-2023-290677.8A maliciously crafted X_B file when parsed through Autodesk® AutoCAD® 2023 could lead to memory corruption vulnerability by write access vio CVE-2023-290687.8A maliciously crafted file consumed through pskernel.dll file could lead to memory corruption vulnerabilities. These vulnerabilities in conj CVE-2023-290697.8A maliciously crafted DLL file can be forced to install onto a non-default location, and attacker can overwrite parts of the product with ma