Clear Text Exposure in Lenovo XClarity Administrator's Log Files
CVE-2019-19756

7.9HIGH

Key Information:

Vendor

Lenovo
Status
Xclarity Administrator (lxca)
Vendor
CVE Published:
13 March 2020

What is CVE-2019-19756?

An internal audit revealed that Lenovo XClarity Administrator version 2.6.0 improperly logs Windows OS credentials in clear text during driver updates. This flaw allows authorized users with access to the First Failure Data Capture (FFDC) service logs to potentially view sensitive information. The exposure occurs specifically in the logs related to the update process, posing a risk of unauthorized access to critical system credentials.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

XClarity Administrator (LXCA) < 2.6.12

References

https://support.lenovo.com/us/en/product_security/LEN-29942
x_refsource_CONFIRM

CVSS V3.1

Score:
7.9
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.