Lucene search

LenovoCVELIST:CVE-2024-45104

HistorySep 13, 2024 - 5:28 p.m.

CVE-2024-45104

2024-09-1317:28:55

CWE-282

lenovo

www.cve.org

lxca user

device modification

web api

CVSS3

6.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

EPSS

0.001

Percentile

16.8%

JSON

A valid, authenticated LXCA user without sufficient privileges may be able to use the device identifier to modify an LXCA managed device through a specially crafted web API call.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "XClarity Administrator",
    "vendor": "Lenovo",
    "versions": [
      {
        "lessThan": "4.1",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]

References

support.lenovo.com/us/en/product_security/LEN-154748