PT-2021-12731 · Lxco · Lxco

Published 2021-03-09 · Updated 2021-03-15 · CVE-2020-8356

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: LXCO versions prior to 1.2.2

Description: An internal product security audit discovered that optional passwords for the Syslog and SMTP forwarders are written to an internal LXCO log file in clear text. The affected logs are captured in the First Failure Data Capture (FFDC) service log, which is only generated when requested by a privileged LXCO user and is only accessible to the privileged LXCO user that requested the file.

Recommendations: For versions prior to 1.2.2, update to version 1.2.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the FFDC service log to minimize the risk of exploitation. Avoid using optional passwords for the Syslog and SMTP forwarders until the issue is resolved.

Fix

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-319

Related Identifiers

CVE-2020-8356

Affected Products

Lxco

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2020-8356 · Security Note
• https://osv.dev/vulnerability/CVE-2020-8356 · Vendor Advisory
• https://support.lenovo.com/us/en/product_security/LEN-49884 · Vendor Advisory
• https://t.me/cibsecurity/24632 · Telegram Post
• https://t.me/cvenotify/11337 · Telegram Post