Authorization

An authorization bypass exists in Lenovo XClarity Controller XCC versions prior to 3.08 CDI340V, 3.01 TEI392O, 1.71 PSI328N where a valid authenticated user with lesser privileges may be granted read-only access to higher-privileged information if 1 “LDAP Authentication Only with Local...

CVE-2019-6195

Lenovo XClarity Controller (XCC) has an authorization bypass vulnerability (CVE-2019-6195) affecting XCC versions prior to 3.08 CDI340V, 3.01 TEI392O, 1.71 PSI328N. If configured with LDAP Authentication Only with Local Authorization and a lower-privileged user logs in within 1 minute of a higher...

CVE-2019-6187

CVE-2019-6187 describes a stored CSV injection in Lenovo XClarity Controller (XCC). The issue arises when a privileged user stores crafted data in XCC fields, leading to malicious formulas in exported CSVs. Public docs conflict on impact: NVD notes the formula is stored but not executed and has n...