Thinkagile Mx3531-f All-flash Firmware vulnerabilities

2 known vulnerabilities in Thinkagile Mx3531-f All-flash Firmware from Lenovo. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.2 High severity

  Lenovo XClarity Controller (XCC): Improper Neutralization of Special Elements used in an SQL Command

  CVE-2023-4608Oct 25, 2023Lenovo

  An authenticated XCC user with elevated privileges can perform blind SQL injection in limited cases through a crafted API command. This affects ThinkSystem v2 and v3 servers with XCC; ThinkSystem v1 servers are not affected.

• 8.1 High severity

  Lenovo XClarity Controller (XCC): Missing Authorization

  CVE-2023-4606Oct 25, 2023Lenovo

  An authenticated XCC user with Read-Only permission can change a different user’s password through a crafted API command. This affects ThinkSystem v2 and v3 servers with XCC; ThinkSystem v1 servers are not affected.