Lenovo Xclarity Controller (Xcc) vulnerabilities

4 vulnerabilities

Known vulnerabilities in Lenovo Xclarity Controller (Xcc), newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

6.5CVE-2019-6187lenovolenovo xclarity controller (xcc)+1
EPSS score
0.86%
A stored CSV Injection vulnerability was reported in Lenovo XClarity Controller (XCC) that could allow an administrative or other appropriately permissioned user to store malformed data in certain XCC server informational fields, that could result in crafted formulas being stored in an exported CSV file. The crafted formula is not executed on XCC itself and has no effect on the server.8.8CVE-2023-4607lenovolenovo xclarity controller (xcc)+123
EPSS score
0.52%
An authenticated XCC user can change permissions for any user through a crafted API command.7.2CVE-2023-4608lenovolenovo xclarity controller (xcc)+58
EPSS score
0.40%
An authenticated XCC user with elevated privileges can perform blind SQL injection in limited cases through a crafted API command.  This affects ThinkSystem v2 and v3 servers with XCC; ThinkSystem v1 servers are not affected.8.1CVE-2023-4606lenovolenovo xclarity controller (xcc)+58
EPSS score
0.55%
An authenticated XCC user with Read-Only permission can change a different user’s password through a crafted API command.   This affects ThinkSystem v2 and v3 servers with XCC; ThinkSystem v1 servers are not affected.