ThinkAgile CP-SB (Storage Block) BMC Session Handling Vulnerability - Lenovo Support US

Lenovo Security Advisory: LEN-26957

Potential Impact: Unauthorized access

Severity: Medium

Scope of Impact: Lenovo-specific

CVE Identifier: CVE-2019-6161

Summary Description:

An internal product security audit discovered a session handling vulnerability in the web interface of ThinkAgile CP-SB (Storage Block) BMC. This vulnerability allows session IDs to be reused, which could provide unauthorized access to the BMC under certain circumstances. This vulnerability does not affect ThinkSystem XCC, System x IMM2, or other BMCs.

Mitigation Strategy for Customers (what you should do to protect yourself):

Upgrade to the firmware version 1908.M (or newer) by contacting your Lenovo account manager.

Revision History:

Revision

|

Date

|

Description

—|—|—
1 | 2019-09-24 | Initial release

For a complete list of all Lenovo Product Security Advisories, click here.

For the most up to date information, please remain current with updates and advisories from Lenovo regarding your equipment and software. The information provided in this advisory is provided on an “as is” basis without any warranty or guarantee of any kind. Lenovo reserves the right to change or update this advisory at any time.