Lucene search

LenovoCVE-2019-6182

HistorySep 03, 2019 - 7:15 p.m.

CVE-2019-6182

2019-09-0319:15:10

CWE-1236

lenovo

web.nvd.nist.gov

115

lenovo

xclarity administrator

lxca

csv injection

vulnerability

cve-2019-6182

nvd

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:N/I:P/A:N

CVSS3

4.9

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

AI Score

Confidence

High

EPSS

0.001

Percentile

22.7%

JSON

A stored CSV Injection vulnerability was reported in Lenovo XClarity Administrator (LXCA) versions prior to 2.5.0 that could allow an administrative user to store malformed data in LXCA Jobs and Event Log data, that could result in crafted formulas stored in an exported CSV file. The crafted formula is not executed on LXCA itself.

Affected configurations

Nvd

Node

lenovoxclarity_administratorRange<2.5.0

VendorProductVersionCPE
lenovoxclarity_administrator*cpe:2.3:a:lenovo:xclarity_administrator:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
lenovo	xclarity_administrator	*	cpe:2.3:a:lenovo:xclarity_administrator::::::::

CNA Affected

[
  {
    "product": "XClarity Administrator (LXCA)",
    "vendor": "Lenovo",
    "versions": [
      {
        "lessThan": "2.5.0",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

support.lenovo.com/solutions/LEN-27805

Social References

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:N/I:P/A:N

CVSS3

4.9

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

AI Score

Confidence

High

EPSS

0.001

Percentile

22.7%

JSON

Related for CVE-2019-6182