PT-2017-16079 · Lenovo · Lenovo Xclarity Administrator

Published 2017-06-20 · Updated 2017-06-30 · CVE-2017-3745

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Lenovo XClarity Administrator versions prior to 1.3.0

Description The issue allows non-administrative users to access password information for previously authenticated users, including administrative and service accounts with administrative privileges, when service data is downloaded. This issue only affects users who have used local authentication with LXCA.

Recommendations For versions prior to 1.3.0, update to version 1.3.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the service data download feature to minimize the risk of exploitation.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2017-3745

Affected Products

Lenovo Xclarity Administrator

References · 3

• https://support.lenovo.com/us/en/product_security/LEN-13671 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-3745 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-3745 · Security Note