PT-2019-18010 · Lenovo · Lenovo Xclarity Administrator

Published 2019-09-03 · Updated 2022-10-14 · CVE-2019-6182

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Lenovo XClarity Administrator versions prior to 2.5.0

Description A stored CSV Injection issue was reported that could allow an administrative user to store malformed data in Jobs and Event Log data. This could result in crafted formulas being stored in an exported CSV file. However, the crafted formula is not executed on the system itself.

Recommendations For versions prior to 2.5.0, update to version 2.5.0 or later to resolve the issue.

Fix

RCE

Weakness Enumeration

CWE-1236

Related Identifiers

CVE-2019-6182

Affected Products

Lenovo Xclarity Administrator

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2019-6182 · Security Note
• https://support.lenovo.com/solutions/LEN-27805 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-6182 · Vendor Advisory