CVE-2024-8279

Friday, September 13, 2024

7.2

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Summary

A privilege escalation vulnerability was discovered in XCC that could allow a valid, authenticated XCC user with elevated privileges to perform command injection via specially crafted file uploads.

Affected Software

Vendor	Product	Version Range	Status
Lenovo	HX5530 Appliance (ThinkAgile) XCC	`0 < 4.71 AFBT48C`	affected
Lenovo	HX7530 Appliance (ThinkAgile) XCC	`0 < 4.71 AFBT48C`	affected
Lenovo	ST250 V3 (ThinkSystem) XCC	`0 < 2.10 CTX312G`	affected
Lenovo	VX3331 Certified Node (ThinkAgile) XCC	`0 < 4.71 AFBT48C`	affected
Lenovo	HX Enclosure Certified Node (ThinkAgile) XCC	`0 < 6.36 TEI3F4A`	affected
Lenovo	HX1021 Edge Certified Node 3yr (ThinkAgile) XCC	`0 < 4.11 TEI3E4A`	affected
Lenovo	HX1320 Appliance (ThinkAgile) XCC	`0 < 9.97 CDI3B4B`	affected
Lenovo	HX1321 Certified Node (ThinkAgile) XCC	`0 < 9.97 CDI3B4B`	affected
Lenovo	HX1331 Certified Node (ThinkAgile) XCC	`0 < 4.71 AFBT48C`	affected
Lenovo	HX1520-R Appliance (ThinkAgile) XCC	`0 < 9.97 CDI3B4B`	affected
Lenovo	HX1521-R Certified Node (ThinkAgile) XCC	`0 < 9.97 CDI3B4B`	affected
Lenovo	HX2320-E Appliance (ThinkAgile) XCC	`0 < 9.97 CDI3B4B`	affected
Lenovo	HX2321 Certified Node (ThinkAgile) XCC	`0 < 9.97 CDI3B4B`	affected
Lenovo	HX2330 Appliance (ThinkAgile) XCC	`0 < 4.71 AFBT48C`	affected
Lenovo	HX2331 Certified Node (ThinkAgile) XCC	`0 < 4.71 AFBT48C`	affected
Lenovo	HX2720-E Appliance (ThinkAgile) XCC	`0 < 6.36 TEI3F4A`	affected
Lenovo	HX3320 Appliance (ThinkAgile) XCC	`0 < 9.97 CDI3B4B`	affected
Lenovo	HX3321 Certified Node (ThinkAgile) XCC	`0 < 9.97 CDI3B4B`	affected
Lenovo	HX3330 Appliance (ThinkAgile) XCC	`0 < 4.71 AFBT48C`	affected
Lenovo	HX3331 Certified Node (ThinkAgile) XCC	`0 < 4.71 AFBT48C`	affected
Lenovo	HX3331 Node SAP HANA (ThinkAgile) XCC	`0 < 4.71 AFBT48C`	affected
Lenovo	HX3375 Appliance (ThinkAgile) XCC	`0 < 5.61 D8BT64D`	affected
Lenovo	HX3376 Certified Node (ThinkAgile) XCC	`0 < 5.61 D8BT64D`	affected
Lenovo	HX3520-G Appliance (ThinkAgile) XCC	`0 < 9.97 CDI3B4B`	affected
Lenovo	HX3521-G Certified Node (ThinkAgile) XCC	`0 < 9.97 CDI3B4B`	affected
Lenovo	HX3720 Appliance (ThinkAgile) XCC	`0 < 6.36 TEI3F4A`	affected
Lenovo	HX3721 Certified Node (ThinkAgile) XCC	`0 < 6.36 TEI3F4A`	affected
Lenovo	HX5520 Appliance (ThinkAgile) XCC	`0 < 9.97 CDI3B4B`	affected
Lenovo	HX5520-C Appliance (ThinkAgile) XCC	`0 < 9.97 CDI3B4B`	affected
Lenovo	HX5521 Certified Node (ThinkAgile) XCC	`0 < 9.97 CDI3B4B`	affected
Lenovo	HX5521-C Certified Node (ThinkAgile) XCC	`0 < 9.97 CDI3B4B`	affected
Lenovo	HX5531 Certified Node (ThinkAgile) XCC	`0 < 4.71 AFBT48C`	affected
Lenovo	HX7520 Appliance (ThinkAgile) XCC	`0 < 9.97 CDI3B4B`	affected
Lenovo	HX7521 Certified Node (ThinkAgile) XCC	`0 < 9.97 CDI3B4B`	affected
Lenovo	HX7530 Appl for SAP HANA (ThinkAgile) XCC	`0 < 4.71 AFBT48C`	affected
Lenovo	HX7531 Certified Node (ThinkAgile) XCC	`0 < 4.71 AFBT48C`	affected
Lenovo	HX7531 Node SAP HANA (ThinkAgile) XCC	`0 < 4.71 AFBT48C`	affected
Lenovo	HX7820 Appliance (ThinkAgile) XCC	`0 < 3.11 PSI354A`	affected
Lenovo	HX7821 Certified Node (ThinkAgile) XCC	`0 < 3.11 PSI354A`	affected
Lenovo	MX Edge Appliance - MX1020 (ThinkAgile) XCC	`0 < 4.11 TEI3E4A`	affected
Lenovo	MX3330-F All-flash Appliance (ThinkAgile) XCC	`0 < 4.71 AFBT48C`	affected
Lenovo	MX3330-H Hybrid Appliance (ThinkAgile) XCC	`0 < 4.71 AFBT48C`	affected
Lenovo	MX3331-F All-flash Certified node (ThinkAgile) XCC	`0 < 4.71 AFBT48C`	affected
Lenovo	MX3331-H Hybrid Certified node (ThinkAgile) XCC	`0 < 4.71 AFBT48C`	affected
Lenovo	MX3530 F All flash Appliance (ThinkAgile) XCC	`0 < 4.71 AFBT48C`	affected
Lenovo	MX3530-H Hybrid Appliance (ThinkAgile) XCC	`0 < 4.71 AFBT48C`	affected
Lenovo	MX3531 H Hybrid Certified node (ThinkAgile) XCC	`0 < 4.71 AFBT48C`	affected
Lenovo	MX3531-F All-flash Certified node (ThinkAgile) XCC	`0 < 4.71 AFBT48C`	affected
Lenovo	P920 Rack Workstation (ThinkStation) XCC	`0 < 9.97 CDI3B4B`	affected
Lenovo	SD530 (ThinkSystem) XCC	`0 < 6.36 TEI3F4A`	affected
Lenovo	SD530 V3 (ThinkSystem) XCC	`0 < 1.20 USX352`	affected
Lenovo	SD550 V3 (ThinkSystem) XCC	`0 < 1.20 USX352`	affected
Lenovo	SD630 V2 (ThinkSystem) XCC	`0 < 4.11 TGBT50C`	affected
Lenovo	SD650 DWC Dual Node Tray (ThinkSystem) XCC	`0 < 6.36 TEI3F4A`	affected
Lenovo	SD650 V2 (ThinkSystem) XCC	`0 < 4.11 TGBT50C`	affected
Lenovo	SD650 V3 (ThinkSystem) XCC	`0 < 6.10 USX350G`	affected
Lenovo	SD650-N V2 (ThinkSystem) XCC	`0 < 4.11 TGBT50C`	affected
Lenovo	SD665 V3 (ThinkSystem) XCC	`0 < 6.10 QGX340J`	affected
Lenovo	SE350 (ThinkSystem) XCC	`0 < 4.11 TEI3E4A`	affected
Lenovo	SE350 V2 (ThinkEdge) XCC	`0 < 3.11 IYX328M`	affected
Lenovo	SE360 V2 (ThinkEdge) XCC	`0 < 3.11 IYX328M`	affected
Lenovo	SE450 (ThinkEdge) XCC	`0 < 3.11 USX332X`	affected
Lenovo	SE455 V3 (ThinkEdge) XCC	`0 < 3.10 MBX308L`	affected
Lenovo	SN550 (ThinkSystem) XCC	`0 < 6.36 TEI3F4A`	affected
Lenovo	SN550 V2 (ThinkSystem) XCC	`0 < 4.11 TGBT50C`	affected
Lenovo	SN850 (ThinkSystem) XCC	`0 < 6.36 TEI3F4A`	affected
Lenovo	SR150 (ThinkSystem) XCC	`0 < 6.36 TEI3F4A`	affected
Lenovo	SR158 (ThinkSystem) XCC	`0 < 6.36 TEI3F4A`	affected
Lenovo	SR250 (ThinkSystem) XCC	`0 < 6.36 TEI3F4A`	affected
Lenovo	SR250 V2 (ThinkSystem) XCC	`0 < 4.11 TGBT50C`	affected
Lenovo	SR250 V3 (ThinkSystem) XCC	`0 < 2.10 CTX312G`	affected
Lenovo	SR258 (ThinkSystem) XCC	`0 < 6.36 TEI3F4A`	affected
Lenovo	SR258 V2 (ThinkSystem) XCC	`0 < 4.11 TGBT50C`	affected
Lenovo	SR258 V3 (ThinkSystem) XCC	`0 < 2.10 CTX312G`	affected
Lenovo	SR530 (ThinkSystem) XCC	`0 < 9.97 CDI3B4B`	affected
Lenovo	SR550 (ThinkSystem) XCC	`0 < 9.97 CDI3B4B`	affected
Lenovo	SR570 (ThinkSystem) XCC	`0 < 9.97 CDI3B4B`	affected
Lenovo	SR590 (ThinkSystem) XCC	`0 < 9.97 CDI3B4B`	affected
Lenovo	SR630 (ThinkSystem) XCC	`0 < 9.97 CDI3B4B`	affected
Lenovo	SR630 V2 (ThinkSystem) XCC	`0 < 4.71 AFBT48C`	affected
Lenovo	SR630 V3 (ThinkSystem) XCC	`0 < 5.10 ESX330M`	affected
Lenovo	SR635 V3 (ThinkSystem) XCC	`0 < 3.20 KAX334O`	affected
Lenovo	SR645 (ThinkSystem) XCC	`0 < 5.61 D8BT64D`	affected
Lenovo	SR645 V3 (ThinkSystem) XCC	`0 < 3.20 KAX334O`	affected
Lenovo	SR650 (ThinkSystem) XCC	`0 < 9.97 CDI3B4B`	affected
Lenovo	SR650 V2 (ThinkSystem) XCC	`0 < 4.71 AFBT48C`	affected
Lenovo	SR650 V3 (ThinkSystem) XCC	`0 < 5.10 ESX330M`	affected
Lenovo	SR655 V3 (ThinkSystem) XCC	`0 < 3.20 KAX334O`	affected
Lenovo	SR665 (ThinkSystem) XCC	`0 < 5.61 D8BT64D`	affected
Lenovo	SR665 V3 (ThinkSystem) XCC	`0 < 3.20 KAX334O`	affected
Lenovo	SR670 (ThinkSystem) XCC	`0 < 4.11 TEI3E4A`	affected
Lenovo	SR670 V2 (ThinkSystem) XCC	`0 < 4.11 TGBT50C`	affected
Lenovo	SR675 V3 (ThinkSystem) XCC	`0 < 6.10 QGX340J`	affected
Lenovo	SR850 (ThinkSystem) XCC	`0 < 6.36 TEI3F4A`	affected
Lenovo	SR850 V2 (ThinkSystem) XCC	`0 < 4.11 TGBT50C`	affected
Lenovo	SR850 V3 (ThinkSystem) XCC	`0 < 4.10 RSX312I`	affected
Lenovo	SR850P (ThinkSystem) XCC	`0 < 4.11 TEI3E4A`	affected
Lenovo	SR860 (ThinkSystem) XCC	`0 < 6.36 TEI3F4A`	affected
Lenovo	SR860 V2 (ThinkSystem) XCC	`0 < 4.11 TGBT50C`	affected
Lenovo	SR860 V3 (ThinkSystem) XCC	`0 < 4.10 RSX312I`	affected
Lenovo	SR950 (ThinkSystem) XCC	`0 < 3.11 PSI354A`	affected
Lenovo	SR950 V3 (ThinkSystem) XCC	`0 < 3.10 EBX308I`	affected
Lenovo	ST250 (ThinkSystem) XCC	`0 < 6.36 TEI3F4A`	affected
Lenovo	ST250 V2 (ThinkSystem) XCC	`0 < 4.11 TGBT50C`	affected
Lenovo	ST258 (ThinkSystem) XCC	`0 < 6.36 TEI3F4A`	affected
Lenovo	ST258 V2 (ThinkSystem) XCC	`0 < 4.11 TGBT50C`	affected
Lenovo	ST258 V3 (ThinkSystem) XCC	`0 < 2.10 CTX312G`	affected
Lenovo	ST550 (ThinkSystem) XCC	`0 < 9.97 CDI3B4B`	affected
Lenovo	ST650 V2 (ThinkSystem) XCC	`0 < 4.11 TGBT50C`	affected
Lenovo	ST650 V3 (ThinkSystem) XCC	`0 < 6.10 USX350G`	affected
Lenovo	ST658 V2 (ThinkSystem) XCC	`0 < 4.11 TGBT50C`	affected
Lenovo	ST658 V3 (ThinkSystem) XCC	`0 < 6.10 USX350G`	affected
Lenovo	ThinkAgile MX1021 on SE350 XCC	`0 < 4.11 TEI3E4A`	affected
Lenovo	VX 1SE Certified Node (ThinkAgile) XCC	`0 < 6.36 TEI3F4A`	affected
Lenovo	VX 2U4N Certified Node (ThinkAgile) XCC	`0 < 6.36 TEI3F4A`	affected
Lenovo	VX 4U Certified Node (ThinkAgile) XCC	`0 < 3.11 PSI354A`	affected
Lenovo	VX1320 (ThinkAgile) XCC	`0 < 6.36 TEI3F4A`	affected
Lenovo	VX2320 (ThinkAgile) XCC	`0 < 9.97 CDI3B4B`	affected
Lenovo	VX2330 Appliance (ThinkAgile) XCC	`0 < 4.71 AFBT48C`	affected
Lenovo	VX3320 (ThinkAgile) XCC	`0 < 9.97 CDI3B4B`	affected
Lenovo	VX3330 Appliance (ThinkAgile) XCC	`0 < 4.71 AFBT48C`	affected
Lenovo	VX3520-G (ThinkAgile) XCC	`0 < 9.97 CDI3B4B`	affected
Lenovo	VX3530-G Appliance (ThinkAgile) XCC	`0 < 4.71 AFBT48C`	affected
Lenovo	VX3720 (ThinkAgile) XCC	`0 < 6.36 TEI3F4A`	affected
Lenovo	VX5520 (ThinkAgile) XCC	`0 < 9.97 CDI3B4B`	affected
Lenovo	VX5530 Appliance (ThinkAgile) XCC	`0 < 4.71 AFBT48C`	affected
Lenovo	VX635 V3 Integrated System (ThinkAgile) XCC	`0 < 3.20 KAX334O`	affected
Lenovo	VX645 V3 Certified Node (ThinkAgile) XCC	`0 < 3.20 KAX334O`	affected
Lenovo	VX645 V3 Integrated System (ThinkAgile) XCC	`0 < 3.20 KAX334O`	affected
Lenovo	VX655 V3 Certified Node (ThinkAgile) XCC	`0 < 3.20 KAX334O`	affected
Lenovo	VX655 V3 Integrated System (ThinkAgile) XCC	`0 < 3.20 KAX334O`	affected
Lenovo	VX665 V3 Certified Node (ThinkAgile) XCC	`0 < 3.20 KAX334O`	affected
Lenovo	VX665 V3 Integrated System (ThinkAgile) XCC	`0 < 3.20 KAX334O`	affected
Lenovo	VX7320 N (ThinkAgile) XCC	`0 < 9.97 CDI3B4B`	affected
Lenovo	VX7330 Appliance (Thinkagile) XCC	`0 < 4.71 AFBT48C`	affected
Lenovo	VX7520 (ThinkAgile) XCC	`0 < 9.97 CDI3B4B`	affected
Lenovo	VX7520 N (ThinkAgile) XCC	`0 < 9.97 CDI3B4B`	affected
Lenovo	VX7530 Appliance (ThinkAgile) XCC	`0 < 4.71 AFBT48C`	affected
Lenovo	VX7531 Certified Node (ThinkAgile) XCC	`0 < 4.71 AFBT48C`	affected
Lenovo	VX7820 (ThinkAgile) XCC	`0 < 3.11 PSI354A`	affected

Weaknesses

CWE-78: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

ADP Enrichment

CISA ADP Vulnrichment

SSVC:
Exploitation: none
- Automatable: no
- Technical Impact: total

References

https://support.lenovo.com/us/en/product_security/LEN-172051

Feedback

Was this page helpful?

Glad to hear it! Please tell us how we can improve.

Sorry to hear that. Please tell us how we can improve.