Credential Exposure in Lenovo xClarity Administrator

CVE-2018-9065

What is CVE-2018-9065?

In Lenovo xClarity Administrator prior to version 2.1.0, an attacker with access to the LXCA file system may exploit a vulnerability to obtain a credential store. This store holds sensitive service processor usernames and passwords associated with servers previously managed by that LXCA instance. The attacker can potentially decrypt these credentials more easily than intended, which poses a significant security risk.

References