PT-2020-10231 · Lenovo · Lenovo Xclarity Administrator

Published 2020-02-14 · Updated 2020-02-24 · CVE-2019-19757

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Lenovo XClarity Administrator versions prior to 2.6.6

Description The issue is a Document Object Model (DOM) based cross-site scripting vulnerability. It could allow JavaScript code to be executed in the user's web browser if a specially crafted link is visited. The JavaScript code is executed on the user's system, not on the Lenovo XClarity Administrator itself.

Recommendations For versions prior to 2.6.6, update to version 2.6.6 or later to resolve the issue. As a temporary workaround, consider avoiding visits to specially crafted links that could exploit this vulnerability. Restrict access to untrusted websites or links to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-19757

Affected Products

Lenovo Xclarity Administrator

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2019-19757 · Security Note
• https://support.lenovo.com/us/en/product_security/LEN-29477 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-19757 · Vendor Advisory
• https://t.me/cvenotify/1032 · Telegram Post