Lucene search

[email protected]CVE-2019-6178

HistoryAug 19, 2019 - 4:15 p.m.

CVE-2019-6178

2019-08-1916:15:11

[email protected]

web.nvd.nist.gov

cve-2019-6178

information leakage

iomega

lenovoemc

nas

device api

personal cloud

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

5.9 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

36.0%

JSON

An information leakage vulnerability in Iomega and LenovoEMC NAS products could allow disclosure of some device details such as Share names through the device API when Personal Cloud is enabled. This does not allow read, write, delete, or any other access to the underlying file systems and their contents.

Affected configurations

NVD

Node

lenovopx12-350r_firmwareMatch4.0.24.34808

AND

lenovopx12-350rMatch-

Node

lenovoix12-300r_firmwareMatch4.0.24.34808

AND

lenovoix12-300rMatch-

Node

lenovohome_media_network_hard_drive_firmwareMatch3.2.16.30221cloud

AND

lenovohome_media_network_hard_driveMatch-cloud

Node

lenovostorecenter_ix2-200_firmwareMatch3.2.16.30221cloud

AND

lenovostorecenter_ix2-200Match-cloud

Node

lenovostorecenter_ix4-200d_firmwareMatch3.2.16.30221cloud

AND

lenovostorecenter_ix4-200dMatch-cloud

Node

lenovostorecenter_ix2-200_firmwareMatch2.1.50.30227

AND

lenovostorecenter_ix2-200Match-

Node

lenovostorecenter_ix4-200d_firmwareMatch2.1.50.30227

AND

lenovostorecenter_ix4-200dMatch-

Node

lenovostorecenter_ix4-200rl_firmwareMatch2.1.50.30227

AND

lenovostorecenter_ix4-200rlMatch-

CPENameOperatorVersion
lenovo:px12-350r_firmwarelenovo px12-350r firmwareeq4.0.24.34808

CPE	Name	Operator	Version
lenovo:px12-350r_firmware	lenovo px12-350r firmware	eq	4.0.24.34808

CNA Affected

[
  {
    "product": "NAS products",
    "vendor": "Iomega and LenovoEMC",
    "versions": [
      {
        "status": "affected",
        "version": "various"
      }
    ]
  }
]

References

support.lenovo.com/solutions/LEN-25557

Social References

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

5.9 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

36.0%

JSON

Related for CVE-2019-6178

cvelist1 nvd1 prion1 lenovo2