LXCA User Account Names Exposed To Unauthenticated Users Who Can Access the Web User Interface - lu

Lenovo Security Advisory: LEN-16335

Potential Impact: LXCA user account names may be exposed to unauthenticated users with access to the LXCA web user interface

Severity: Medium

Scope of Impact: Lenovo Specific

**CVE Identifier:**CVE-2017-3764

Summary Description:

A vulnerability was identified in Lenovo XClarity Administrator (LXCA) where LXCA user account names may be exposed to unauthenticated users with access to the LXCA web user interface. No password information of the user accounts is exposed.

Lenovo XClarity Administrator is a centralized, resource-management solution for Lenovo server systems and solutions.

Mitigation Strategy for Customers (what you should do to protect yourself):

Update LXCA to the latest version, 1.4.0 or later, or limit connectivity to the LXCA web user interface to trusted management networks.

For a complete list of all Lenovo Product Security Advisories, click here.

Revision History:

Revision

|

Date

|

Description

—|—|—

1

|

11/30/2017

|

Initial release

For the most up to date information, please remain current with updates and advisories from Lenovo regarding your equipment and software. The information provided in this advisory is provided on as “as is” basis without any warranty or guarantee of any kind. Lenovo reserves the right to change or update this advisory at any time.