PT-2024-31433 · Lenovo · Lenovo Xclarity Administrator

Published 2024-09-13 · Updated 2024-12-13 · CVE-2024-45103

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Lenovo XClarity Administrator versions up to 4.0

Description A valid, authenticated LXCA user may be able to unmanage an LXCA managed device through the LXCA web interface without sufficient privileges. This issue may lead to potential privilege escalation.

Recommendations For versions up to 4.0, upgrade the affected component immediately to resolve the issue. As a temporary workaround, consider restricting access to the LXCA web interface to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-282

Related Identifiers

CVE-2024-45103

Affected Products

Lenovo Xclarity Administrator

References · 9

• https://osv.dev/vulnerability/CVE-2024-45103 · Vendor Advisory
• https://support.lenovo.com/us/en/product_security/LEN-154748 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-45103 · Security Note
• https://twitter.com/VulmonFeeds/status/1834698655225332131 · Twitter Post
• https://twitter.com/oktsec/status/1834717284276773223 · Twitter Post
• https://twitter.com/CVEnew/status/1834648938831659458 · Twitter Post
• https://t.me/cvedetector/5643 · Telegram Post
• https://t.me/cvenotify/104265 · Telegram Post
• https://t.me/cvenotify/95191 · Telegram Post