Authorization Bypass in Lenovo XClarity Controller

CVE-2019-6195

Summary

An authorization bypass vulnerability in Lenovo XClarity Controller allows a valid authenticated user with lesser privileges access to higher-privileged information under specific conditions. If configured to use 'LDAP Authentication Only with Local Authorization,' a lower-privileged user can gain read-only access to sensitive data if they log in shortly after a higher-privileged user logs out. The issue does not manifest under other authentication configurations, highlighting the importance of proper mode selection to protect sensitive information.

References