Stored Cross-Site Scripting Vulnerability in Lenovo XClarity Administrator
CVE-2019-6180

4.8MEDIUM

Key Information:

Vendor
Lenovo
Status
Xclarity Administrator (lxca)
Vendor
CVE Published:
3 September 2019

Summary

A stored cross-site scripting vulnerability exists in Lenovo XClarity Administrator (LXCA) prior to version 2.5.0, allowing an administrative user to inject malicious JavaScript code. This code is stored within LXCA and can be executed in the web browsers of other users accessing the application. It poses a risk as the scripted content could potentially compromise user actions and lead to unauthorized access.

Affected Version(s)

XClarity Administrator (LXCA) < 2.5.0

References

https://support.lenovo.com/solutions/LEN-27805
x_refsource_MISC

CVSS V3.1

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.