Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2019-6195

An authorization bypass exists in Lenovo XClarity Controller (XCC) versions prior to 3.08 CDI340V, 3.01 TEI392O, 1.71 PSI328N where a valid authenticated user with lesser privileges may be granted read-only access to higher-privileged information if 1) “LDAP Authentication Only with Local Authorization” mode is configured and used by XCC, and 2) a lesser privileged user logs into XCC within 1 minute of a higher privileged user logging out. The authorization bypass does not exist when “Local Authentication and Authorization” or “LDAP Authentication and Authorization” modes are configured and used by XCC.

Published

2020-02-14T17:15:13.223

Last Modified

2024-11-21T04:46:09.123

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 4.8 (MEDIUM)

CVSSv2 Vector

AV:N/AC:H/Au:S/C:P/I:N/A:N

  • Access Vector: NETWORK
  • Access Complexity: HIGH
  • Authentication: SINGLE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: NONE
  • Availability Impact: NONE
Exploitability Score

3.9

Impact Score

2.9

Weaknesses
  • Type: Secondary
    CWE-264
  • Type: Primary
    CWE-269
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application lenovo xclarity_controller < 3.01_tei392o Yes
Hardware lenovo thinkagile_hx_1000 - No
Hardware lenovo thinkagile_hx_2000 - No
Hardware lenovo thinkagile_hx_3000 - No
Hardware lenovo thinkagile_hx_5000 - No
Hardware lenovo thinkagile_hx_7000 - No
Hardware lenovo thinkagile_vx_1000 - No
Hardware lenovo thinkagile_vx_2000 - No
Hardware lenovo thinkagile_vx_3000 - No
Hardware lenovo thinkagile_vx_5000 - No
Hardware lenovo thinkagile_vx_7000 - No
Hardware lenovo thinksystem_sd530 - No
Hardware lenovo thinksystem_sd650_dwc - No
Hardware lenovo thinksystem_sn550 - No
Hardware lenovo thinksystem_sn850 - No
Hardware lenovo thinksystem_sr150 - No
Hardware lenovo thinksystem_sr158 - No
Hardware lenovo thinksystem_sr250 - No
Hardware lenovo thinksystem_sr258 - No
Hardware lenovo thinksystem_sr850 - No
Hardware lenovo thinksystem_sr860 - No
Hardware lenovo thinksystem_st250 - No
Hardware lenovo thinksystem_st258 - No
Application lenovo xclarity_controller < 3.08_cdi340v Yes
Hardware lenovo thinkagile_hx_1000 - No
Hardware lenovo thinkagile_hx_2000 - No
Hardware lenovo thinkagile_hx_3000 - No
Hardware lenovo thinkagile_hx_5000 - No
Hardware lenovo thinkagile_hx_7000 - No
Hardware lenovo thinkagile_mx_sr650 - No
Hardware lenovo thinkagile_vx_1000 - No
Hardware lenovo thinkagile_vx_2000 - No
Hardware lenovo thinkagile_vx_3000 - No
Hardware lenovo thinkagile_vx_5000 - No
Hardware lenovo thinkagile_vx_7000 - No
Hardware lenovo thinksystem_sr530 - No
Hardware lenovo thinksystem_sr550 - No
Hardware lenovo thinksystem_sr570 - No
Hardware lenovo thinksystem_sr590 - No
Hardware lenovo thinksystem_sr630 - No
Hardware lenovo thinksystem_sr650 - No
Hardware lenovo thinksystem_st550 - No
Hardware lenovo thinksystem_st558 - No
Application lenovo xclarity_controller < 1.71_psi328n Yes
Hardware lenovo thinksystem_sr950_server - No
References