CVE-2023-29058CWE-276

A valid, authenticated XCC user with read-only permissions can modify custom user roles on other user accounts and the user trespass message through the XCC…

Medium · published April 28, 2023

CVSS v3.1
6.4
EPSS
0%
Percentile
28.7
In the wild
Unconfirmed
What it is

A valid, authenticated XCC user with read-only permissions can modify custom user roles on other user accounts and the user trespass message through the XCC CLI. There is no exposure if SSH is disabled or if there are no users assigned optional read-only permissions.

The record
Technical detail
CVSS v3.1
6.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00360 · 28.7th percentile
Weakness
CWE-276 · Incorrect Default Permissions
Published
2023-04-28T20:47Z
EPSS history
Timeline
  • 28 APR 20:47Z
    A valid, authenticated XCC user with read-only permissions can modify custom user roles on other user accounts and the user trespass message through the XCC…
    cvelistv5