Lenovo XClarity Integrator Vulnerabilities - US

Lenovo Security Advisory: LEN-23800

**Potential Impact:**Privilege escalation, information disclosure, file system modification

**Severity:**High

**Scope of Impact:**Lenovo-specific

CVE Identifier: CVE-2018-9072, CVE-2018-16093, CVE-2018-16097

Summary Description:

In a recent internal audit, Lenovo identified three security vulnerabilities in the Lenovo XClarity Integrator (LXCI) for VMware and LXCI for Microsoft System Center. These include the following concerns:

CVE-2018-9072: LXCI for VMware allows an authenticated user to download any system file due to insufficient input sanitization during file downloads.

CVE-2018-16093: LXCI for VMware allows an authenticated user to write to any system file due to insufficient sanitization during the upload of a backup file.

CVE-2018-16097: LXCI for VMware and LXCI for Microsoft System Center allow an authenticated user to write to any system file due to insufficient sanitization during the upload of a certificate.

Mitigation Strategy for Customers (what you should do to protect yourself):

Update to LXCI for VMware version 5.5 (or later).

Update to LXCI for Microsoft System Center version 3.5 (or later).

Revision History:

For a complete list of all Lenovo Product Security Advisories, click here.

For the most up to date information, please remain current with updates and advisories from Lenovo regarding your equipment and software. The information provided in this advisory is provided on an “as is” basis without any warranty or guarantee of any kind. Lenovo reserves the right to change or update this advisory at any time.