Lenovo XClarity Administrator (LXCA) Vulnerabilities - Lenovo Support US

Lenovo Security Advisory: LEN-29477

Potential Impact: Information disclosure, code execution

Severity: Medium

Scope of Impact: Lenovo-specific

CVE Identifier: CVE-2019-6193, CVE-2019-6194, CVE-2019-19757

Summary Description:

CVE-2019-6193: An information disclosure vulnerability was reported in Lenovo XClarity Administrator (LXCA) that could allow unauthenticated access to some configuration files which may contain usernames, license keys, IP addresses, and encrypted password hashes.

CVE-2019-6194: An XML External Entity (XXE) processing vulnerability was reported in Lenovo XClarity Administrator (LXCA) that could allow information disclosure.

CVE-2019-19757: An internal product security audit of Lenovo XClarity Administrator (LXCA) discovered a Document Object Model (DOM) based cross-site scripting vulnerability that could allow JavaScript code to be executed in the user’s web browser if a specially crafted link is visited. The JavaScript code is executed on the user’s system, not executed on LXCA itself.

Mitigation Strategy for Customers (what you should do to protect yourself):

Update your LXCA installation to version 2.6.6 or later.

Installation note: You will need to update to LXCA 2.6.0 before installing the latest fix bundle (v 2.6.6).

References:

LXCA 2.6.6 Fix Bundle: <https://datacentersupport.lenovo.com/us/en/solutions/HT509677&gt;

LXCA Updates: <https://support.lenovo.com/us/en/solutions/lnvo-lxcaupd&gt;

Revision History:

Revision

|

Date

|

Description

—|—|—
2 | 2020-02-12 | Clarified installation instructions.
1 | 2020-02-11 | Initial release

For a complete list of all Lenovo Product Security Advisories, click here.

For the most up to date information, please remain current with updates and advisories from Lenovo regarding your equipment and software. The information provided in this advisory is provided on an “as is” basis without any warranty or guarantee of any kind. Lenovo reserves the right to change or update this advisory at any time.