Cross-Site Scripting Vulnerability in Lenovo XClarity Administrator
CVE-2019-19757

5.4MEDIUM

Key Information:

Vendor
Lenovo
Status
Xclarity Administrator (lxca)
Vendor
CVE Published:
14 February 2020

Summary

A cross-site scripting vulnerability was identified in Lenovo XClarity Administrator (LXCA) due to improper handling of document object model (DOM) elements. This issue affects versions prior to 2.6.6, allowing attackers to execute malicious JavaScript code in the web browser of a user who clicks a specially crafted link. The code's execution occurs on the user's local system rather than the LXCA server, emphasizing the need for users to remain vigilant about the links they visit.

Affected Version(s)

XClarity Administrator (LXCA) < 2.6.6

References

https://support.lenovo.com/us/en/product_security/LEN-29477
x_refsource_MISC

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.