CVE-2023-29057

A valid XCC user's local account permissions overrides their active directory permissions under specific configurations. This could lead to a privilege escalation. To be vulnerable, LDAP must be configured for authentication/authorization and logins configured as “Local First, then LDAP”.

• CWE-276

• https://support.lenovo.com/us/en/product_security/LEN-118321Vendor Advisory
• https://support.lenovo.com/us/en/product_security/LEN-118321Vendor Advisory

Published

Apr 28, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-29051User-defined OXMF templates could be used to access a limite…8.1
• CVE-2023-29052Users were able to define disclaimer texts for an upsell sho…5.4
• CVE-2023-29053A vulnerability has been identified in JT Open (All versions…7.8
• CVE-2023-29054A vulnerability has been identified in SCALANCE X200-4P IRT …7.4
• CVE-2023-29055In Apache Kylin version 2.0.0 to 4.0.3, there is a Server Co…7.5
• CVE-2023-29056A valid LDAP user, under specific conditions, will default t…5.9
• CVE-2023-29058A valid, authenticated XCC user with read-only permissions c…6.5
• CVE-2023-290593CX DesktopApp through 18.12.416 has embedded malicious code…7.8
• CVE-2023-2906Due to a failure in validating the length provided by an att…6.5
• CVE-2023-29060The FACSChorus workstation operating system does not restric…5.7
• CVE-2023-29061There is no BIOS password on the FACSChorus workstation. A t…5.2
• CVE-2023-29062The Operating System hosting the FACSChorus application is c…3.8