PT-2017-16079 · Lenovo · Lenovo Xclarity Administrator

Publicado 2017-06-20 · Atualizado 2017-06-30 · CVE-2017-3745

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Lenovo XClarity Administrator versions prior to 1.3.0

Description The issue allows non-administrative users to access password information for previously authenticated users, including administrative and service accounts with administrative privileges, when service data is downloaded. This issue only affects users who have used local authentication with LXCA.

Recommendations For versions prior to 1.3.0, update to version 1.3.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the service data download feature to minimize the risk of exploitation.

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2017-3745

Produtos afetados

Lenovo Xclarity Administrator

Referências · 3

• https://support.lenovo.com/us/en/product_security/LEN-13671 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2017-3745 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-3745 · Nota de Segurança