Lucene search

LenovoCVELIST:CVE-2019-6182

HistorySep 03, 2019 - 6:50 p.m.

CVE-2019-6182

2019-09-0318:50:11

lenovo

www.cve.org

CVSS3

4.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

AI Score

5.2

Confidence

High

EPSS

0.001

Percentile

22.7%

JSON

A stored CSV Injection vulnerability was reported in Lenovo XClarity Administrator (LXCA) versions prior to 2.5.0 that could allow an administrative user to store malformed data in LXCA Jobs and Event Log data, that could result in crafted formulas stored in an exported CSV file. The crafted formula is not executed on LXCA itself.

CNA Affected

[
  {
    "product": "XClarity Administrator (LXCA)",
    "vendor": "Lenovo",
    "versions": [
      {
        "lessThan": "2.5.0",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

support.lenovo.com/solutions/LEN-27805