CVE-2023-3113

HIGH

Lenovo XClarity Administrator CIM Server - XML External Entity File Read

Title source: manual

Description

An unauthenticated XML external entity injection (XXE) vulnerability exists in LXCA's Common Information Model (CIM) server that could result in read-only access to specific files.

References (1)

Core 1

Core References

Vendor Advisory

https://support.lenovo.com/us/en/product_security/LEN-98715

Scores

CVSS v3 8.2

EPSS 0.0017

EPSS Percentile 37.4%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact partial

Details

CWE

CWE-611

Status published

Products (1)

lenovo/xclarity_administrator < 4.0.0

Published Jun 26, 2023

Tracked Since Feb 18, 2026