Clear Text Exposure in Lenovo XClarity Administrator's Log Files

CVE-2019-19756

Summary

An internal audit revealed that Lenovo XClarity Administrator version 2.6.0 improperly logs Windows OS credentials in clear text during driver updates. This flaw allows authorized users with access to the First Failure Data Capture (FFDC) service logs to potentially view sensitive information. The exposure occurs specifically in the logs related to the update process, posing a risk of unauthorized access to critical system credentials.

References