PT-2019-17994 · Lenovo · Thinkagile Cp-Sb

Published 2019-09-26 · Updated 2019-10-01 · CVE-2019-6161

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions ThinkAgile CP-SB (Storage Block) BMC versions prior to 1908.M

Description An internal product security audit discovered a session handling issue in the web interface of the affected product. This issue allows session IDs to be reused, potentially providing unauthorized access to the BMC under certain circumstances.

Recommendations For versions prior to 1908.M, update the firmware to version 1908.M or later to resolve the issue. As a temporary workaround, consider restricting access to the web interface to minimize the risk of exploitation.

Fix

Session Fixation

Weakness Enumeration

CWE-384

Related Identifiers

CVE-2019-6161

Affected Products

Thinkagile Cp-Sb

References · 3

• https://osv.dev/vulnerability/CVE-2019-6161 · Vendor Advisory
• https://support.lenovo.com/solutions/LEN-26957 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-6161 · Security Note