PT-2019-17991 · Lenovo · Lenovo Xclarity Administrator

Publicado 2019-05-03 · Atualizado 2019-10-09 · CVE-2019-6158

Positive Technologies (AI Summary)

CVSS v3.1

8.7

Alta

Vetor base

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Lenovo XClarity Administrator versions 2.0.0 through 2.3.x

Description An internal product security audit discovered that HTTP proxy credentials are being written to a log file in clear text when HTTP proxy credentials have been configured.

Recommendations For versions 2.0.0 through 2.3.x, consider removing or securely storing HTTP proxy credentials to prevent them from being written to log files in clear text. As a temporary workaround, restrict access to log files to minimize the risk of exploitation.

Correção

Insertion into Log File

Enumeração de Fraquezas

CWE-532

Identificadores relacionados

CVE-2019-6158

Produtos afetados

Lenovo Xclarity Administrator

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2019-6158 · Nota de Segurança
• http://securityfocus.com/bid/108165 · Nota
• https://osv.dev/vulnerability/CVE-2019-6158 · Aviso do Fabricante
• https://support.lenovo.com/solutions/LEN-26141 · Aviso do Fabricante