A valid, authenticated user with limited privileges may be able to use specifically crafted web management server API calls to execute a limited number of commands on SMM v1, SMM v2, and FPC that the user does not normally have sufficient privileges to execute.
References
| Link | Resource |
|---|---|
| https://support.lenovo.com/us/en/product_security/LEN-127357 | Vendor Advisory |
| https://support.lenovo.com/us/en/product_security/LEN-127357 | Vendor Advisory |
Configurations
Configuration 1 (hide)
| AND |
|
Configuration 2 (hide)
| AND |
|
Configuration 3 (hide)
| AND |
|
Configuration 4 (hide)
| AND |
|
Configuration 5 (hide)
| AND |
|
Configuration 6 (hide)
| AND |
|
Configuration 7 (hide)
| AND |
|
Configuration 8 (hide)
| AND |
|
History
21 Nov 2024, 07:59
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://support.lenovo.com/us/en/product_security/LEN-127357 - Vendor Advisory | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.4 |
05 Jul 2023, 17:30
| Type | Values Removed | Values Added |
|---|---|---|
| References | (MISC) https://support.lenovo.com/us/en/product_security/LEN-127357 - Vendor Advisory | |
| CPE | cpe:2.3:h:lenovo:thinksystem_d2_enclosure:-:*:*:*:*:*:*:* cpe:2.3:o:lenovo:thinkagile_cp-cb-10_firmware:*:*:*:*:*:*:*:* cpe:2.3:o:lenovo:thinksystem_da240_enclosure_firmware:*:*:*:*:*:*:*:* cpe:2.3:h:lenovo:thinkagile_cp-cb-10:-:*:*:*:*:*:*:* cpe:2.3:h:lenovo:nextscale_n1200_enclosure:-:*:*:*:*:*:*:* cpe:2.3:o:lenovo:thinkagile_cp-cb-10e_firmware:*:*:*:*:*:*:*:* cpe:2.3:o:lenovo:thinkagile_hx_enclosure_certified_node_firmware:*:*:*:*:*:*:*:* cpe:2.3:h:lenovo:thinkagile_vx_enclosure:-:*:*:*:*:*:*:* cpe:2.3:o:lenovo:thinksystem_dw612_enclosure_firmware:*:*:*:*:*:*:*:* cpe:2.3:o:lenovo:thinksystem_d2_enclosure_firmware:*:*:*:*:*:*:*:* cpe:2.3:h:lenovo:thinksystem_dw612_enclosure:-:*:*:*:*:*:*:* cpe:2.3:o:lenovo:nextscale_n1200_enclosure_firmware:*:*:*:*:*:*:*:* cpe:2.3:h:lenovo:thinkagile_cp-cb-10e:-:*:*:*:*:*:*:* cpe:2.3:h:lenovo:thinkagile_hx_enclosure_certified_node:-:*:*:*:*:*:*:* cpe:2.3:o:lenovo:thinkagile_vx_enclosure_firmware:*:*:*:*:*:*:*:* cpe:2.3:h:lenovo:thinksystem_da240_enclosure:-:*:*:*:*:*:*:* |
|
| First Time |
Lenovo thinkagile Hx Enclosure Certified Node Firmware
Lenovo thinksystem Da240 Enclosure Firmware Lenovo thinkagile Cp-cb-10 Lenovo thinkagile Cp-cb-10e Lenovo thinkagile Hx Enclosure Certified Node Lenovo nextscale N1200 Enclosure Lenovo nextscale N1200 Enclosure Firmware Lenovo thinksystem Dw612 Enclosure Firmware Lenovo thinksystem D2 Enclosure Lenovo Lenovo thinkagile Vx Enclosure Firmware Lenovo thinksystem D2 Enclosure Firmware Lenovo thinksystem Dw612 Enclosure Lenovo thinksystem Da240 Enclosure Lenovo thinkagile Cp-cb-10e Firmware Lenovo thinkagile Vx Enclosure Lenovo thinkagile Cp-cb-10 Firmware |
|
| CWE | CWE-281 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.3 |
26 Jun 2023, 20:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-06-26 20:15
Updated : 2024-11-21 07:59
NVD link : CVE-2023-2993
Mitre link : CVE-2023-2993
CVE.ORG link : CVE-2023-2993
JSON object : View
Products Affected
lenovo
- thinksystem_dw612_enclosure_firmware
- thinksystem_da240_enclosure
- thinksystem_da240_enclosure_firmware
- thinksystem_dw612_enclosure
- nextscale_n1200_enclosure_firmware
- thinkagile_cp-cb-10_firmware
- thinkagile_hx_enclosure_certified_node
- thinkagile_cp-cb-10
- thinkagile_cp-cb-10e
- thinkagile_hx_enclosure_certified_node_firmware
- thinksystem_d2_enclosure
- thinkagile_cp-cb-10e_firmware
- thinkagile_vx_enclosure_firmware
- thinksystem_d2_enclosure_firmware
- nextscale_n1200_enclosure
- thinkagile_vx_enclosure
CWE
CWE-281
Improper Preservation of Permissions