{"id":"CVE-2023-4608","aliases":["EUVD-2023-54461","GHSA-96gf-qq25-2c24"],"status":"published","title":"An authenticated XCC user with elevated privileges can perform blind SQL injection in limited...","description":"An authenticated XCC user with elevated privileges can perform blind SQL injection in limited cases through a crafted API command. \n\nThis affects ThinkSystem v2 and v3 servers with XCC; ThinkSystem v1 servers are not affected.","severity":{"version":"3.1","score":4.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00405,"percentile":0.35087,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-89"],"published":"2023-10-24T20:25:49Z","modified":"2026-06-17T06:38:13Z","products":[{"vendor":"lenovo","product":"lenovo xclarity controller (xcc)"},{"vendor":"lenovo","product":"thinkagile_hx1331_firmware"},{"vendor":"lenovo","product":"thinkagile_hx2330_firmware"},{"vendor":"lenovo","product":"thinkagile_hx2331_firmware"},{"vendor":"lenovo","product":"thinkagile_hx3330_firmware"},{"vendor":"lenovo","product":"thinkagile_hx3331_firmware"},{"vendor":"lenovo","product":"thinkagile_hx3375_firmware"},{"vendor":"lenovo","product":"thinkagile_hx3376_firmware"},{"vendor":"lenovo","product":"thinkagile_hx5530_firmware"},{"vendor":"lenovo","product":"thinkagile_hx5531_firmware"},{"vendor":"lenovo","product":"thinkagile_hx7530_firmware"},{"vendor":"lenovo","product":"thinkagile_hx7531_firmware"},{"vendor":"lenovo","product":"thinkagile_mx3330-f_all-flash_firmware"},{"vendor":"lenovo","product":"thinkagile_mx3330-h_hybrid_firmware"},{"vendor":"lenovo","product":"thinkagile_mx3331-f_all-flash_firmware"},{"vendor":"lenovo","product":"thinkagile_mx3331-h_hybrid_firmware"},{"vendor":"lenovo","product":"thinkagile_mx3530-h_hybrid_firmware"},{"vendor":"lenovo","product":"thinkagile_mx3530_f_all_flash_firmware"},{"vendor":"lenovo","product":"thinkagile_mx3531-f_all-flash_firmware"},{"vendor":"lenovo","product":"thinkagile_mx3531_h_hybrid_firmware"},{"vendor":"lenovo","product":"thinkagile_vx2330_firmware"},{"vendor":"lenovo","product":"thinkagile_vx3330_firmware"},{"vendor":"lenovo","product":"thinkagile_vx3331_firmware"},{"vendor":"lenovo","product":"thinkagile_vx3530-g_firmware"},{"vendor":"lenovo","product":"thinkagile_vx5530_firmware"},{"vendor":"lenovo","product":"thinkagile_vx7330_firmware"},{"vendor":"lenovo","product":"thinkagile_vx7530_firmware"},{"vendor":"lenovo","product":"thinkagile_vx7531_firmware"},{"vendor":"lenovo","product":"thinksystem_sd630_v2_firmware"},{"vendor":"lenovo","product":"thinksystem_sd650-n_v2_firmware"},{"vendor":"lenovo","product":"thinksystem_sd650_v2_firmware"},{"vendor":"lenovo","product":"thinksystem_sd650_v3_firmware"},{"vendor":"lenovo","product":"thinksystem_sd665_v3_firmware"},{"vendor":"lenovo","product":"thinksystem_sn550_v2_firmware"},{"vendor":"lenovo","product":"thinksystem_sr250_firmware"},{"vendor":"lenovo","product":"thinksystem_sr258_v2_firmware"},{"vendor":"lenovo","product":"thinksystem_sr630_v2_firmware"},{"vendor":"lenovo","product":"thinksystem_sr630_v3_firmware"},{"vendor":"lenovo","product":"thinksystem_sr635_v3_firmware"},{"vendor":"lenovo","product":"thinksystem_sr645_firmware"},{"vendor":"lenovo","product":"thinksystem_sr645_v3_firmware"},{"vendor":"lenovo","product":"thinksystem_sr650_v2_firmware"},{"vendor":"lenovo","product":"thinksystem_sr650_v3_firmware"},{"vendor":"lenovo","product":"thinksystem_sr655_v3_firmware"},{"vendor":"lenovo","product":"thinksystem_sr665_firmware"},{"vendor":"lenovo","product":"thinksystem_sr665_v3_firmware"},{"vendor":"lenovo","product":"thinksystem_sr670_firmware"},{"vendor":"lenovo","product":"thinksystem_sr670_v2_firmware"},{"vendor":"lenovo","product":"thinksystem_sr675_v3_firmware"},{"vendor":"lenovo","product":"thinksystem_sr850_v2_firmware"},{"vendor":"lenovo","product":"thinksystem_sr850_v3_firmware"},{"vendor":"lenovo","product":"thinksystem_sr860_v2_firmware"},{"vendor":"lenovo","product":"thinksystem_sr860_v3_firmware"},{"vendor":"lenovo","product":"thinksystem_st250_v2_firmware"},{"vendor":"lenovo","product":"thinksystem_st258_v2_firmware"},{"vendor":"lenovo","product":"thinksystem_st650_v2_firmware"},{"vendor":"lenovo","product":"thinksystem_st650_v3_firmware"},{"vendor":"lenovo","product":"thinksystem_st658_v2_firmware"},{"vendor":"lenovo","product":"thinksystem_st658_v3_firmware"}],"references":[{"url":"https://support.lenovo.com/us/en/product_security/LEN-140960","tags":["x_transferred","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-4608"},{"url":"https://github.com/advisories/GHSA-96gf-qq25-2c24"}],"sources":{"cve":[{"id":"CVE-2023-4608","description":"An authenticated XCC user with elevated privileges can perform blind SQL injection in limited cases through a crafted API command. \n\nThis affects ThinkSystem v2 and v3 servers with XCC; ThinkSystem v1 servers are not affected.","status":"published","published":"2023-10-24T20:25:49.416Z","modified":"2024-09-11T20:38:29.704Z","cvss":[{"version":"3.1","score":4.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:35:30.474787Z"}],"euvd":[{"id":"EUVD-2023-54461","description":"An authenticated XCC user with elevated privileges can perform blind SQL injection in limited cases through a crafted API command. \n\nThis affects ThinkSystem v2 and v3 servers with XCC; ThinkSystem v1 servers are not affected.","status":"published","published":"2023-10-24T20:25:49Z","modified":"2024-09-11T20:38:29Z","cvss":[{"version":"3.1","score":4.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-03T00:55:57.81164Z"}],"ghsa":[{"id":"GHSA-96gf-qq25-2c24","title":"An authenticated XCC user with elevated privileges can perform blind SQL injection in limited...","description":"An authenticated XCC user with elevated privileges can perform blind SQL injection in limited cases through a crafted API command. \n\nThis affects ThinkSystem v2 and v3 servers with XCC; ThinkSystem v1 servers are not affected.","status":"published","published":"2023-10-25T18:32:25Z","modified":"2023-11-16T05:03:54Z","cvss":[{"version":"3.1","score":4.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:55:02.891904Z"}],"nvd":[{"id":"CVE-2023-4608","description":"An authenticated XCC user with elevated privileges can perform blind SQL injection in limited cases through a crafted API command. \n\nThis affects ThinkSystem v2 and v3 servers with XCC; ThinkSystem v1 servers are not affected.","status":"published","published":"2023-10-25T18:17:41.67Z","modified":"2026-06-17T06:38:13.017Z","cvss":[{"version":"3.1","score":4.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:08:40.004465Z"}]}}