XClarity Administrator (LXCA) Service Data May Include Proxy Credentials - Lenovo Support US

Lenovo Security Advisory: LEN-26141

Potential Impact: Information disclosure

Severity: High

Scope of Impact: Lenovo-specific

CVE Identifier: CVE-2019-6158

Summary Description:

An internal product security audit of Lenovo XClarity Administrator (LXCA) discovered HTTP proxy credentials being written to a log file in clear text. This only affects LXCA when HTTP proxy credentials have been configured. This affects LXCA versions 2.0.0 to 2.3.x.

Mitigation Strategy for Customers (what you should do to protect yourself):

Update your LXCA installation to version 2.4 or later.

Revision History:

For a complete list of all Lenovo Product Security Advisories, click here.

For the most up to date information, please remain current with updates and advisories from Lenovo regarding your equipment and software. The information provided in this advisory is provided on an “as is” basis without any warranty or guarantee of any kind. Lenovo reserves the right to change or update this advisory at any time.