CVE-2019-6195 - Vulnerability Details

Vendors	Products
Lenovo	Thinkagile Hx 1000 Thinkagile Hx 2000 Thinkagile Hx 3000 Thinkagile Hx 5000 Thinkagile Hx 7000 Thinkagile Mx Sr650 Thinkagile Vx 1000 Thinkagile Vx 2000 Thinkagile Vx 3000 Thinkagile Vx 5000 Thinkagile Vx 7000 Thinksystem Sd530 Thinksystem Sd650 Dwc Thinksystem Sn550 Thinksystem Sn850 Thinksystem Sr150 Thinksystem Sr158 Thinksystem Sr250 Thinksystem Sr258 Thinksystem Sr530 Thinksystem Sr550 Thinksystem Sr570 Thinksystem Sr590 Thinksystem Sr630 Thinksystem Sr650 Thinksystem Sr850 Thinksystem Sr860 Thinksystem Sr950 Server Thinksystem St250 Thinksystem St258 Thinksystem St550 Thinksystem St558 Xclarity Controller

Link	Providers
https://support.lenovo.com/us/en/product_security/LEN-29116

Show plain JSON

{"containers": {"cna": {"affected": [{"product": "XClarity Controller (XCC)", "vendor": "Lenovo", "versions": [{"lessThan": "3.08 CDI340V", "status": "affected", "version": "unspecified", "versionType": "custom"}, {"lessThan": "3.01 TEI392O", "status": "affected", "version": "unspecified", "versionType": "custom"}, {"lessThan": "1.71 PSI328N", "status": "affected", "version": "unspecified", "versionType": "custom"}]}], "datePublic": "2020-02-14T00:00:00", "descriptions": [{"lang": "en", "value": "An authorization bypass exists in Lenovo XClarity Controller (XCC) versions prior to 3.08 CDI340V, 3.01 TEI392O, 1.71 PSI328N where a valid authenticated user with lesser privileges may be granted read-only access to higher-privileged information if 1) \u201cLDAP Authentication Only with Local Authorization\u201d mode is configured and used by XCC, and 2) a lesser privileged user logs into XCC within 1 minute of a higher privileged user logging out. The authorization bypass does not exist when \u201cLocal Authentication and Authorization\u201d or \u201cLDAP Authentication and Authorization\u201d modes are configured and used by XCC."}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-264", "description": "CWE-264 Permissions, Privileges, and Access Controls", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2020-02-14T17:10:27", "orgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b", "shortName": "lenovo"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://support.lenovo.com/us/en/product_security/LEN-29116"}], "solutions": [{"lang": "en", "value": "Update to Lenovo XClarity Controller (XCC) version 3.08 CDI340V, 3.01 TEI392O, 1.71 PSI328N or higher."}], "source": {"advisory": "LEN-29116", "discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 0.0.9"}, "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "psirt@lenovo.com", "DATE_PUBLIC": "2020-02-14T17:00:00.000Z", "ID": "CVE-2019-6195", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "XClarity Controller (XCC)", "version": {"version_data": [{"version_affected": "<", "version_value": "3.08 CDI340V"}, {"version_affected": "<", "version_value": "3.01 TEI392O"}, {"version_affected": "<", "version_value": "1.71 PSI328N"}]}}]}, "vendor_name": "Lenovo"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "An authorization bypass exists in Lenovo XClarity Controller (XCC) versions prior to 3.08 CDI340V, 3.01 TEI392O, 1.71 PSI328N where a valid authenticated user with lesser privileges may be granted read-only access to higher-privileged information if 1) \u201cLDAP Authentication Only with Local Authorization\u201d mode is configured and used by XCC, and 2) a lesser privileged user logs into XCC within 1 minute of a higher privileged user logging out. The authorization bypass does not exist when \u201cLocal Authentication and Authorization\u201d or \u201cLDAP Authentication and Authorization\u201d modes are configured and used by XCC."}]}, "generator": {"engine": "Vulnogram 0.0.9"}, "impact": {"cvss": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-264 Permissions, Privileges, and Access Controls"}]}]}, "references": {"reference_data": [{"name": "https://support.lenovo.com/us/en/product_security/LEN-29116", "refsource": "MISC", "url": "https://support.lenovo.com/us/en/product_security/LEN-29116"}]}, "solution": [{"lang": "en", "value": "Update to Lenovo XClarity Controller (XCC) version 3.08 CDI340V, 3.01 TEI392O, 1.71 PSI328N or higher."}], "source": {"advisory": "LEN-29116", "discovery": "UNKNOWN"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T20:16:24.464Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://support.lenovo.com/us/en/product_security/LEN-29116"}]}]}, "cveMetadata": {"assignerOrgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b", "assignerShortName": "lenovo", "cveId": "CVE-2019-6195", "datePublished": "2020-02-14T17:10:27.559154Z", "dateReserved": "2019-01-11T00:00:00", "dateUpdated": "2024-09-16T16:14:10.788Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{

containers : { »

cna : { »

affected : [ »

0 : { »

product : XClarity Controller (XCC) (string)

vendor : Lenovo (string)

versions : [ »

0 : { »

lessThan : 3.08 CDI340V (string)

status : affected (string)

version : unspecified (string)

versionType : custom (string)

}

1 : { »

lessThan : 3.01 TEI392O (string)

status : affected (string)

version : unspecified (string)

versionType : custom (string)

}

2 : { »

lessThan : 1.71 PSI328N (string)

status : affected (string)

version : unspecified (string)

versionType : custom (string)

}

]

}

]

datePublic : 2020-02-14T00:00:00 (string)

descriptions : [ »

0 : { »

lang : en (string)

value : An authorization bypass exists in Lenovo XClarity Controller (XCC) versions prior to 3.08 CDI340V, 3.01 TEI392O, 1.71 PSI328N where a valid authenticated user with lesser privileges may be granted read-only access to higher-privileged information if 1) “LDAP Authentication Only with Local Authorization” mode is configured and used by XCC, and 2) a lesser privileged user logs into XCC within 1 minute of a higher privileged user logging out. The authorization bypass does not exist when “Local Authentication and Authorization” or “LDAP Authentication and Authorization” modes are configured and used by XCC. (string)

}

]

metrics : [ »

0 : { »

cvssV3_1 : { »

attackComplexity : HIGH (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 4.8 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : HIGH (string)

integrityImpact : NONE (string)

privilegesRequired : LOW (string)

scope : UNCHANGED (string)

userInteraction : REQUIRED (string)

vectorString : CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N (string)

version : 3.1 (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

cweId : CWE-264 (string)

description : CWE-264 Permissions, Privileges, and Access Controls (string)

lang : en (string)

type : CWE (string)

}

]

}

]

providerMetadata : { »

dateUpdated : 2020-02-14T17:10:27 (string)

orgId : da227ddf-6e25-4b41-b023-0f976dcaca4b (string)

shortName : lenovo (string)

}

references : [ »

0 : { »

tags : [ »

0 : x_refsource_MISC (string)

]

url : https://support.lenovo.com/us/en/product_security/LEN-29116 (string)

}

]

solutions : [ »

0 : { »

lang : en (string)

value : Update to Lenovo XClarity Controller (XCC) version 3.08 CDI340V, 3.01 TEI392O, 1.71 PSI328N or higher. (string)

}

]

source : { »

advisory : LEN-29116 (string)

discovery : UNKNOWN (string)

}

x_generator : { »

engine : Vulnogram 0.0.9 (string)

}

x_legacyV4Record : { »

CVE_data_meta : { »

ASSIGNER : psirt@lenovo.com (string)

DATE_PUBLIC : 2020-02-14T17:00:00.000Z (string)

ID : CVE-2019-6195 (string)

STATE : PUBLIC (string)

}

affects : { »

vendor : { »

vendor_data : [ »

0 : { »

product : { »

product_data : [ »

0 : { »

product_name : XClarity Controller (XCC) (string)

version : { »

version_data : [ »

0 : { »

version_affected : < (string)

version_value : 3.08 CDI340V (string)

}

1 : { »

version_affected : < (string)

version_value : 3.01 TEI392O (string)

}

2 : { »

version_affected : < (string)

version_value : 1.71 PSI328N (string)

}

]

}

]

}

vendor_name : Lenovo (string)

}

]

}

data_format : MITRE (string)

data_type : CVE (string)

data_version : 4.0 (string)

description : { »

description_data : [ »

0 : { »

lang : eng (string)

value : An authorization bypass exists in Lenovo XClarity Controller (XCC) versions prior to 3.08 CDI340V, 3.01 TEI392O, 1.71 PSI328N where a valid authenticated user with lesser privileges may be granted read-only access to higher-privileged information if 1) “LDAP Authentication Only with Local Authorization” mode is configured and used by XCC, and 2) a lesser privileged user logs into XCC within 1 minute of a higher privileged user logging out. The authorization bypass does not exist when “Local Authentication and Authorization” or “LDAP Authentication and Authorization” modes are configured and used by XCC. (string)

}

]

}

generator : { »

engine : Vulnogram 0.0.9 (string)

}

impact : { »

cvss : { »

attackComplexity : HIGH (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 4.8 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : HIGH (string)

integrityImpact : NONE (string)

privilegesRequired : LOW (string)

scope : UNCHANGED (string)

userInteraction : REQUIRED (string)

vectorString : CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N (string)

version : 3.1 (string)

}

problemtype : { »

problemtype_data : [ »

0 : { »

description : [ »

0 : { »

lang : eng (string)

value : CWE-264 Permissions, Privileges, and Access Controls (string)

}

]

}

]

}

references : { »

reference_data : [ »

0 : { »

name : https://support.lenovo.com/us/en/product_security/LEN-29116 (string)

refsource : MISC (string)

url : https://support.lenovo.com/us/en/product_security/LEN-29116 (string)

}

]

}

solution : [ »

0 : { »

lang : en (string)

value : Update to Lenovo XClarity Controller (XCC) version 3.08 CDI340V, 3.01 TEI392O, 1.71 PSI328N or higher. (string)

}

]

source : { »

advisory : LEN-29116 (string)

discovery : UNKNOWN (string)

}

adp : [ »

0 : { »

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-04T20:16:24.464Z (string)

}

title : CVE Program Container (string)

references : [ »

0 : { »

tags : [ »

0 : x_refsource_MISC (string)

1 : x_transferred (string)

]

url : https://support.lenovo.com/us/en/product_security/LEN-29116 (string)

}

]

}

]

}

cveMetadata : { »

assignerOrgId : da227ddf-6e25-4b41-b023-0f976dcaca4b (string)

assignerShortName : lenovo (string)

cveId : CVE-2019-6195 (string)

datePublished : 2020-02-14T17:10:27.559154Z (string)

dateReserved : 2019-01-11T00:00:00 (string)

dateUpdated : 2024-09-16T16:14:10.788Z (string)

state : PUBLISHED (string)

}

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:lenovo:xclarity_controller:*:*:*:*:*:*:*:*", "matchCriteriaId": "1008B2EE-5CA0-44D3-A5E4-BD558AA954DE", "versionEndExcluding": "3.01_tei392o", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:lenovo:thinkagile_hx_1000:-:*:*:*:*:*:*:*", "matchCriteriaId": "861FD9CF-A71F-4B9F-AD63-89BEFF9FB170", "vulnerable": false}, {"criteria": "cpe:2.3:h:lenovo:thinkagile_hx_2000:-:*:*:*:*:*:*:*", "matchCriteriaId": "46A03175-61F0-4077-B6E6-54967E012FE3", "vulnerable": false}, {"criteria": "cpe:2.3:h:lenovo:thinkagile_hx_3000:-:*:*:*:*:*:*:*", "matchCriteriaId": "61548AD5-85A8-45E2-8E42-3879190C32E6", "vulnerable": false}, {"criteria": "cpe:2.3:h:lenovo:thinkagile_hx_5000:-:*:*:*:*:*:*:*", "matchCriteriaId": "BAEAD534-FE95-4E16-91F1-9ABDB96E3B5E", "vulnerable": false}, {"criteria": "cpe:2.3:h:lenovo:thinkagile_hx_7000:-:*:*:*:*:*:*:*", "matchCriteriaId": "E7A98501-D0CA-410E-86D3-A5E1420D1D3A", "vulnerable": false}, {"criteria": "cpe:2.3:h:lenovo:thinkagile_vx_1000:-:*:*:*:*:*:*:*", "matchCriteriaId": "7AABC0D8-FCA9-46D0-A147-DF6D65154465", "vulnerable": false}, {"criteria": "cpe:2.3:h:lenovo:thinkagile_vx_2000:-:*:*:*:*:*:*:*", "matchCriteriaId": "A2DBC750-1F52-4418-BA06-95A3C33B2757", "vulnerable": false}, {"criteria": "cpe:2.3:h:lenovo:thinkagile_vx_3000:-:*:*:*:*:*:*:*", "matchCriteriaId": "F86AB334-137C-4DC6-AFCD-6CBFBEA862DA", "vulnerable": false}, {"criteria": "cpe:2.3:h:lenovo:thinkagile_vx_5000:-:*:*:*:*:*:*:*", "matchCriteriaId": "0553591B-FAFC-4601-92C0-5212D86FB60B", "vulnerable": false}, {"criteria": "cpe:2.3:h:lenovo:thinkagile_vx_7000:-:*:*:*:*:*:*:*", "matchCriteriaId": "26D5D977-101A-4D02-AAFC-05D1E8C81D6B", "vulnerable": false}, {"criteria": "cpe:2.3:h:lenovo:thinksystem_sd530:-:*:*:*:*:*:*:*", "matchCriteriaId": "2588DA2E-6E58-4FA2-9AA6-FC669C042197", "vulnerable": false}, {"criteria": "cpe:2.3:h:lenovo:thinksystem_sd650_dwc:-:*:*:*:*:*:*:*", "matchCriteriaId": "D32821FA-D82A-450D-BA5B-E020CD1BEDA8", "vulnerable": false}, {"criteria": "cpe:2.3:h:lenovo:thinksystem_sn550:-:*:*:*:*:*:*:*", "matchCriteriaId": "5DB64709-93BA-43D8-A1DB-4CE405291430", "vulnerable": false}, {"criteria": "cpe:2.3:h:lenovo:thinksystem_sn850:-:*:*:*:*:*:*:*", "matchCriteriaId": "1DB0C393-2CB4-485F-93E2-2F28B19F9325", "vulnerable": false}, {"criteria": "cpe:2.3:h:lenovo:thinksystem_sr150:-:*:*:*:*:*:*:*", "matchCriteriaId": "C6334030-07E4-45F4-A233-4A37F77FC573", "vulnerable": false}, {"criteria": "cpe:2.3:h:lenovo:thinksystem_sr158:-:*:*:*:*:*:*:*", "matchCriteriaId": "D94182EE-10FE-4506-BDE0-06F4140923FC", "vulnerable": false}, {"criteria": "cpe:2.3:h:lenovo:thinksystem_sr250:-:*:*:*:*:*:*:*", "matchCriteriaId": "C5B52AC1-714E-4217-8599-80D99E0D33B3", "vulnerable": false}, {"criteria": "cpe:2.3:h:lenovo:thinksystem_sr258:-:*:*:*:*:*:*:*", "matchCriteriaId": "DB19D273-4975-4957-AE94-117B607CD746", "vulnerable": false}, {"criteria": "cpe:2.3:h:lenovo:thinksystem_sr850:-:*:*:*:*:*:*:*", "matchCriteriaId": "19771143-D5F1-4F2F-AB83-09913894681E", "vulnerable": false}, {"criteria": "cpe:2.3:h:lenovo:thinksystem_sr860:-:*:*:*:*:*:*:*", "matchCriteriaId": "EAF08144-ECCB-477B-A934-E4578522BFEE", "vulnerable": false}, {"criteria": "cpe:2.3:h:lenovo:thinksystem_st250:-:*:*:*:*:*:*:*", "matchCriteriaId": "DBF2350D-34B1-44DB-8E4A-6F29B37D96CF", "vulnerable": false}, {"criteria": "cpe:2.3:h:lenovo:thinksystem_st258:-:*:*:*:*:*:*:*", "matchCriteriaId": "089F97B1-FEDE-4A5D-91D3-0517E8D39174", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:lenovo:xclarity_controller:*:*:*:*:*:*:*:*", "matchCriteriaId": "72CC8224-6832-4C72-8414-58AA7228002E", "versionEndExcluding": "3.08_cdi340v", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:lenovo:thinkagile_hx_1000:-:*:*:*:*:*:*:*", "matchCriteriaId": "861FD9CF-A71F-4B9F-AD63-89BEFF9FB170", "vulnerable": false}, {"criteria": "cpe:2.3:h:lenovo:thinkagile_hx_2000:-:*:*:*:*:*:*:*", "matchCriteriaId": "46A03175-61F0-4077-B6E6-54967E012FE3", "vulnerable": false}, {"criteria": "cpe:2.3:h:lenovo:thinkagile_hx_3000:-:*:*:*:*:*:*:*", "matchCriteriaId": "61548AD5-85A8-45E2-8E42-3879190C32E6", "vulnerable": false}, {"criteria": "cpe:2.3:h:lenovo:thinkagile_hx_5000:-:*:*:*:*:*:*:*", "matchCriteriaId": "BAEAD534-FE95-4E16-91F1-9ABDB96E3B5E", "vulnerable": false}, {"criteria": "cpe:2.3:h:lenovo:thinkagile_hx_7000:-:*:*:*:*:*:*:*", "matchCriteriaId": "E7A98501-D0CA-410E-86D3-A5E1420D1D3A", "vulnerable": false}, {"criteria": "cpe:2.3:h:lenovo:thinkagile_mx_sr650:-:*:*:*:*:*:*:*", "matchCriteriaId": "C08EE1EA-C77F-4077-9B46-5ABEAC022979", "vulnerable": false}, {"criteria": "cpe:2.3:h:lenovo:thinkagile_vx_1000:-:*:*:*:*:*:*:*", "matchCriteriaId": "7AABC0D8-FCA9-46D0-A147-DF6D65154465", "vulnerable": false}, {"criteria": "cpe:2.3:h:lenovo:thinkagile_vx_2000:-:*:*:*:*:*:*:*", "matchCriteriaId": "A2DBC750-1F52-4418-BA06-95A3C33B2757", "vulnerable": false}, {"criteria": "cpe:2.3:h:lenovo:thinkagile_vx_3000:-:*:*:*:*:*:*:*", "matchCriteriaId": "F86AB334-137C-4DC6-AFCD-6CBFBEA862DA", "vulnerable": false}, {"criteria": "cpe:2.3:h:lenovo:thinkagile_vx_5000:-:*:*:*:*:*:*:*", "matchCriteriaId": "0553591B-FAFC-4601-92C0-5212D86FB60B", "vulnerable": false}, {"criteria": "cpe:2.3:h:lenovo:thinkagile_vx_7000:-:*:*:*:*:*:*:*", "matchCriteriaId": "26D5D977-101A-4D02-AAFC-05D1E8C81D6B", "vulnerable": false}, {"criteria": "cpe:2.3:h:lenovo:thinksystem_sr530:-:*:*:*:*:*:*:*", "matchCriteriaId": "F4C6628A-8A99-4841-A7C5-0445A03C638D", "vulnerable": false}, {"criteria": "cpe:2.3:h:lenovo:thinksystem_sr550:-:*:*:*:*:*:*:*", "matchCriteriaId": "D10850BF-A7EA-4B84-B2EF-66DCCC301514", "vulnerable": false}, {"criteria": "cpe:2.3:h:lenovo:thinksystem_sr570:-:*:*:*:*:*:*:*", "matchCriteriaId": "8A7C5BE3-5429-46B0-B0B5-C86A9B6376A7", "vulnerable": false}, {"criteria": "cpe:2.3:h:lenovo:thinksystem_sr590:-:*:*:*:*:*:*:*", "matchCriteriaId": "A3DC615C-A88A-4C45-892F-77C5E84104E8", "vulnerable": false}, {"criteria": "cpe:2.3:h:lenovo:thinksystem_sr630:-:*:*:*:*:*:*:*", "matchCriteriaId": "D7F10C8D-C9C7-4FAD-980D-7A602C8BE81D", "vulnerable": false}, {"criteria": "cpe:2.3:h:lenovo:thinksystem_sr650:-:*:*:*:*:*:*:*", "matchCriteriaId": "C6C2B5BB-6E1F-4E01-AAE8-A8239AB8945E", "vulnerable": false}, {"criteria": "cpe:2.3:h:lenovo:thinksystem_st550:-:*:*:*:*:*:*:*", "matchCriteriaId": "A5B19107-5B45-4E45-8B34-90B5A1FF3962", "vulnerable": false}, {"criteria": "cpe:2.3:h:lenovo:thinksystem_st558:-:*:*:*:*:*:*:*", "matchCriteriaId": "30CFA6D5-7D07-4BFF-8AD2-DE591EDE0186", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:lenovo:xclarity_controller:*:*:*:*:*:*:*:*", "matchCriteriaId": "5068D399-065C-4E84-A546-B19EE2E4DBD3", "versionEndExcluding": "1.71_psi328n", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:lenovo:thinksystem_sr950_server:-:*:*:*:*:*:*:*", "matchCriteriaId": "0DF54D69-A781-45F8-852F-3A9D575ADB75", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "An authorization bypass exists in Lenovo XClarity Controller (XCC) versions prior to 3.08 CDI340V, 3.01 TEI392O, 1.71 PSI328N where a valid authenticated user with lesser privileges may be granted read-only access to higher-privileged information if 1) \u201cLDAP Authentication Only with Local Authorization\u201d mode is configured and used by XCC, and 2) a lesser privileged user logs into XCC within 1 minute of a higher privileged user logging out. The authorization bypass does not exist when \u201cLocal Authentication and Authorization\u201d or \u201cLDAP Authentication and Authorization\u201d modes are configured and used by XCC."}, {"lang": "es", "value": "Se presenta una omisi\u00f3n de autorizaci\u00f3n en Lenovo XClarity Controller (XCC) versiones anteriores a 3.08 CDI340V, versi\u00f3n 3.01 TEI392O, versi\u00f3n 1.71 PSI328N, donde un usuario autenticado v\u00e1lido con privilegios menores puede tener acceso de solo de lectura a informaci\u00f3n con privilegios superiores si 1) \"LDAP Authentication Only with Local Authorization\u201d es configurado y utilizado por XCC, y 2) un usuario con menos privilegios inicia sesi\u00f3n en XCC dentro de 1 minuto despu\u00e9s de que un usuario con mayor privilegio cierre sesi\u00f3n. La omisi\u00f3n de autorizaci\u00f3n no se presenta cuando los modos \u201cLocal Authentication and Authorization\u201d o \u201cLDAP Authentication and Authorization\u201d son configurados y utilizados por XCC."}], "id": "CVE-2019-6195", "lastModified": "2024-11-21T04:46:09.123", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "HIGH", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 2.1, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:H/Au:S/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 3.6, "source": "psirt@lenovo.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2020-02-14T17:15:13.223", "references": [{"source": "psirt@lenovo.com", "tags": ["Vendor Advisory"], "url": "https://support.lenovo.com/us/en/product_security/LEN-29116"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://support.lenovo.com/us/en/product_security/LEN-29116"}], "sourceIdentifier": "psirt@lenovo.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-264"}], "source": "psirt@lenovo.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-269"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:lenovo:xclarity_controller:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 1008B2EE-5CA0-44D3-A5E4-BD558AA954DE (string)

versionEndExcluding : 3.01_tei392o (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

1 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:h:lenovo:thinkagile_hx_1000:-:*:*:*:*:*:*:* (string)

matchCriteriaId : 861FD9CF-A71F-4B9F-AD63-89BEFF9FB170 (string)

vulnerable : false (boolean)

}

1 : { »

criteria : cpe:2.3:h:lenovo:thinkagile_hx_2000:-:*:*:*:*:*:*:* (string)

matchCriteriaId : 46A03175-61F0-4077-B6E6-54967E012FE3 (string)

vulnerable : false (boolean)

}

2 : { »

criteria : cpe:2.3:h:lenovo:thinkagile_hx_3000:-:*:*:*:*:*:*:* (string)

matchCriteriaId : 61548AD5-85A8-45E2-8E42-3879190C32E6 (string)

vulnerable : false (boolean)

}

3 : { »

criteria : cpe:2.3:h:lenovo:thinkagile_hx_5000:-:*:*:*:*:*:*:* (string)

matchCriteriaId : BAEAD534-FE95-4E16-91F1-9ABDB96E3B5E (string)

vulnerable : false (boolean)

}

4 : { »

criteria : cpe:2.3:h:lenovo:thinkagile_hx_7000:-:*:*:*:*:*:*:* (string)

matchCriteriaId : E7A98501-D0CA-410E-86D3-A5E1420D1D3A (string)

vulnerable : false (boolean)

}

5 : { »

criteria : cpe:2.3:h:lenovo:thinkagile_vx_1000:-:*:*:*:*:*:*:* (string)

matchCriteriaId : 7AABC0D8-FCA9-46D0-A147-DF6D65154465 (string)

vulnerable : false (boolean)

}

6 : { »

criteria : cpe:2.3:h:lenovo:thinkagile_vx_2000:-:*:*:*:*:*:*:* (string)

matchCriteriaId : A2DBC750-1F52-4418-BA06-95A3C33B2757 (string)

vulnerable : false (boolean)

}

7 : { »

criteria : cpe:2.3:h:lenovo:thinkagile_vx_3000:-:*:*:*:*:*:*:* (string)

matchCriteriaId : F86AB334-137C-4DC6-AFCD-6CBFBEA862DA (string)

vulnerable : false (boolean)

}

8 : { »

criteria : cpe:2.3:h:lenovo:thinkagile_vx_5000:-:*:*:*:*:*:*:* (string)

matchCriteriaId : 0553591B-FAFC-4601-92C0-5212D86FB60B (string)

vulnerable : false (boolean)

}

9 : { »

criteria : cpe:2.3:h:lenovo:thinkagile_vx_7000:-:*:*:*:*:*:*:* (string)

matchCriteriaId : 26D5D977-101A-4D02-AAFC-05D1E8C81D6B (string)

vulnerable : false (boolean)

}

10 : { »

criteria : cpe:2.3:h:lenovo:thinksystem_sd530:-:*:*:*:*:*:*:* (string)

matchCriteriaId : 2588DA2E-6E58-4FA2-9AA6-FC669C042197 (string)

vulnerable : false (boolean)

}

11 : { »

criteria : cpe:2.3:h:lenovo:thinksystem_sd650_dwc:-:*:*:*:*:*:*:* (string)

matchCriteriaId : D32821FA-D82A-450D-BA5B-E020CD1BEDA8 (string)

vulnerable : false (boolean)

}

12 : { »

criteria : cpe:2.3:h:lenovo:thinksystem_sn550:-:*:*:*:*:*:*:* (string)

matchCriteriaId : 5DB64709-93BA-43D8-A1DB-4CE405291430 (string)

vulnerable : false (boolean)

}

13 : { »

criteria : cpe:2.3:h:lenovo:thinksystem_sn850:-:*:*:*:*:*:*:* (string)

matchCriteriaId : 1DB0C393-2CB4-485F-93E2-2F28B19F9325 (string)

vulnerable : false (boolean)

}

14 : { »

criteria : cpe:2.3:h:lenovo:thinksystem_sr150:-:*:*:*:*:*:*:* (string)

matchCriteriaId : C6334030-07E4-45F4-A233-4A37F77FC573 (string)

vulnerable : false (boolean)

}

15 : { »

criteria : cpe:2.3:h:lenovo:thinksystem_sr158:-:*:*:*:*:*:*:* (string)

matchCriteriaId : D94182EE-10FE-4506-BDE0-06F4140923FC (string)

vulnerable : false (boolean)

}

16 : { »

criteria : cpe:2.3:h:lenovo:thinksystem_sr250:-:*:*:*:*:*:*:* (string)

matchCriteriaId : C5B52AC1-714E-4217-8599-80D99E0D33B3 (string)

vulnerable : false (boolean)

}

17 : { »

criteria : cpe:2.3:h:lenovo:thinksystem_sr258:-:*:*:*:*:*:*:* (string)

matchCriteriaId : DB19D273-4975-4957-AE94-117B607CD746 (string)

vulnerable : false (boolean)

}

18 : { »

criteria : cpe:2.3:h:lenovo:thinksystem_sr850:-:*:*:*:*:*:*:* (string)

matchCriteriaId : 19771143-D5F1-4F2F-AB83-09913894681E (string)

vulnerable : false (boolean)

}

19 : { »

criteria : cpe:2.3:h:lenovo:thinksystem_sr860:-:*:*:*:*:*:*:* (string)

matchCriteriaId : EAF08144-ECCB-477B-A934-E4578522BFEE (string)

vulnerable : false (boolean)

}

20 : { »

criteria : cpe:2.3:h:lenovo:thinksystem_st250:-:*:*:*:*:*:*:* (string)

matchCriteriaId : DBF2350D-34B1-44DB-8E4A-6F29B37D96CF (string)

vulnerable : false (boolean)

}

21 : { »

criteria : cpe:2.3:h:lenovo:thinksystem_st258:-:*:*:*:*:*:*:* (string)

matchCriteriaId : 089F97B1-FEDE-4A5D-91D3-0517E8D39174 (string)

vulnerable : false (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

operator : AND (string)

}

1 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:lenovo:xclarity_controller:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 72CC8224-6832-4C72-8414-58AA7228002E (string)

versionEndExcluding : 3.08_cdi340v (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

1 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:h:lenovo:thinkagile_hx_1000:-:*:*:*:*:*:*:* (string)

matchCriteriaId : 861FD9CF-A71F-4B9F-AD63-89BEFF9FB170 (string)

vulnerable : false (boolean)

}

1 : { »

criteria : cpe:2.3:h:lenovo:thinkagile_hx_2000:-:*:*:*:*:*:*:* (string)

matchCriteriaId : 46A03175-61F0-4077-B6E6-54967E012FE3 (string)

vulnerable : false (boolean)

}

2 : { »

criteria : cpe:2.3:h:lenovo:thinkagile_hx_3000:-:*:*:*:*:*:*:* (string)

matchCriteriaId : 61548AD5-85A8-45E2-8E42-3879190C32E6 (string)

vulnerable : false (boolean)

}

3 : { »

criteria : cpe:2.3:h:lenovo:thinkagile_hx_5000:-:*:*:*:*:*:*:* (string)

matchCriteriaId : BAEAD534-FE95-4E16-91F1-9ABDB96E3B5E (string)

vulnerable : false (boolean)

}

4 : { »

criteria : cpe:2.3:h:lenovo:thinkagile_hx_7000:-:*:*:*:*:*:*:* (string)

matchCriteriaId : E7A98501-D0CA-410E-86D3-A5E1420D1D3A (string)

vulnerable : false (boolean)

}

5 : { »

criteria : cpe:2.3:h:lenovo:thinkagile_mx_sr650:-:*:*:*:*:*:*:* (string)

matchCriteriaId : C08EE1EA-C77F-4077-9B46-5ABEAC022979 (string)

vulnerable : false (boolean)

}

6 : { »

criteria : cpe:2.3:h:lenovo:thinkagile_vx_1000:-:*:*:*:*:*:*:* (string)

matchCriteriaId : 7AABC0D8-FCA9-46D0-A147-DF6D65154465 (string)

vulnerable : false (boolean)

}

7 : { »

criteria : cpe:2.3:h:lenovo:thinkagile_vx_2000:-:*:*:*:*:*:*:* (string)

matchCriteriaId : A2DBC750-1F52-4418-BA06-95A3C33B2757 (string)

vulnerable : false (boolean)

}

8 : { »

criteria : cpe:2.3:h:lenovo:thinkagile_vx_3000:-:*:*:*:*:*:*:* (string)

matchCriteriaId : F86AB334-137C-4DC6-AFCD-6CBFBEA862DA (string)

vulnerable : false (boolean)

}

9 : { »

criteria : cpe:2.3:h:lenovo:thinkagile_vx_5000:-:*:*:*:*:*:*:* (string)

matchCriteriaId : 0553591B-FAFC-4601-92C0-5212D86FB60B (string)

vulnerable : false (boolean)

}

10 : { »

criteria : cpe:2.3:h:lenovo:thinkagile_vx_7000:-:*:*:*:*:*:*:* (string)

matchCriteriaId : 26D5D977-101A-4D02-AAFC-05D1E8C81D6B (string)

vulnerable : false (boolean)

}

11 : { »

criteria : cpe:2.3:h:lenovo:thinksystem_sr530:-:*:*:*:*:*:*:* (string)

matchCriteriaId : F4C6628A-8A99-4841-A7C5-0445A03C638D (string)

vulnerable : false (boolean)

}

12 : { »

criteria : cpe:2.3:h:lenovo:thinksystem_sr550:-:*:*:*:*:*:*:* (string)

matchCriteriaId : D10850BF-A7EA-4B84-B2EF-66DCCC301514 (string)

vulnerable : false (boolean)

}

13 : { »

criteria : cpe:2.3:h:lenovo:thinksystem_sr570:-:*:*:*:*:*:*:* (string)

matchCriteriaId : 8A7C5BE3-5429-46B0-B0B5-C86A9B6376A7 (string)

vulnerable : false (boolean)

}

14 : { »

criteria : cpe:2.3:h:lenovo:thinksystem_sr590:-:*:*:*:*:*:*:* (string)

matchCriteriaId : A3DC615C-A88A-4C45-892F-77C5E84104E8 (string)

vulnerable : false (boolean)

}

15 : { »

criteria : cpe:2.3:h:lenovo:thinksystem_sr630:-:*:*:*:*:*:*:* (string)

matchCriteriaId : D7F10C8D-C9C7-4FAD-980D-7A602C8BE81D (string)

vulnerable : false (boolean)

}

16 : { »

criteria : cpe:2.3:h:lenovo:thinksystem_sr650:-:*:*:*:*:*:*:* (string)

matchCriteriaId : C6C2B5BB-6E1F-4E01-AAE8-A8239AB8945E (string)

vulnerable : false (boolean)

}

17 : { »

criteria : cpe:2.3:h:lenovo:thinksystem_st550:-:*:*:*:*:*:*:* (string)

matchCriteriaId : A5B19107-5B45-4E45-8B34-90B5A1FF3962 (string)

vulnerable : false (boolean)

}

18 : { »

criteria : cpe:2.3:h:lenovo:thinksystem_st558:-:*:*:*:*:*:*:* (string)

matchCriteriaId : 30CFA6D5-7D07-4BFF-8AD2-DE591EDE0186 (string)

vulnerable : false (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

operator : AND (string)

}

2 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:lenovo:xclarity_controller:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 5068D399-065C-4E84-A546-B19EE2E4DBD3 (string)

versionEndExcluding : 1.71_psi328n (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

1 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:h:lenovo:thinksystem_sr950_server:-:*:*:*:*:*:*:* (string)

matchCriteriaId : 0DF54D69-A781-45F8-852F-3A9D575ADB75 (string)

vulnerable : false (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

operator : AND (string)

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : An authorization bypass exists in Lenovo XClarity Controller (XCC) versions prior to 3.08 CDI340V, 3.01 TEI392O, 1.71 PSI328N where a valid authenticated user with lesser privileges may be granted read-only access to higher-privileged information if 1) “LDAP Authentication Only with Local Authorization” mode is configured and used by XCC, and 2) a lesser privileged user logs into XCC within 1 minute of a higher privileged user logging out. The authorization bypass does not exist when “Local Authentication and Authorization” or “LDAP Authentication and Authorization” modes are configured and used by XCC. (string)

}

1 : { »

lang : es (string)

value : Se presenta una omisión de autorización en Lenovo XClarity Controller (XCC) versiones anteriores a 3.08 CDI340V, versión 3.01 TEI392O, versión 1.71 PSI328N, donde un usuario autenticado válido con privilegios menores puede tener acceso de solo de lectura a información con privilegios superiores si 1) "LDAP Authentication Only with Local Authorization” es configurado y utilizado por XCC, y 2) un usuario con menos privilegios inicia sesión en XCC dentro de 1 minuto después de que un usuario con mayor privilegio cierre sesión. La omisión de autorización no se presenta cuando los modos “Local Authentication and Authorization” o “LDAP Authentication and Authorization” son configurados y utilizados por XCC. (string)

}

]

id : CVE-2019-6195 (string)

lastModified : 2024-11-21T04:46:09.123 (string)

metrics : { »

cvssMetricV2 : [ »

0 : { »

acInsufInfo : false (boolean)

baseSeverity : LOW (string)

cvssData : { »

accessComplexity : HIGH (string)

accessVector : NETWORK (string)

authentication : SINGLE (string)

availabilityImpact : NONE (string)

baseScore : 2.1 (number)

confidentialityImpact : PARTIAL (string)

integrityImpact : NONE (string)

vectorString : AV:N/AC:H/Au:S/C:P/I:N/A:N (string)

version : 2.0 (string)

}

exploitabilityScore : 3.9 (number)

impactScore : 2.9 (number)

obtainAllPrivilege : false (boolean)

obtainOtherPrivilege : false (boolean)

obtainUserPrivilege : false (boolean)

source : nvd@nist.gov (string)

type : Primary (string)

userInteractionRequired : true (boolean)

}

]

cvssMetricV31 : [ »

0 : { »

cvssData : { »

attackComplexity : HIGH (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 4.8 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : HIGH (string)

integrityImpact : NONE (string)

privilegesRequired : LOW (string)

scope : UNCHANGED (string)

userInteraction : REQUIRED (string)

vectorString : CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N (string)

version : 3.1 (string)

}

exploitabilityScore : 1.2 (number)

impactScore : 3.6 (number)

source : psirt@lenovo.com (string)

type : Secondary (string)

}

1 : { »

cvssData : { »

attackComplexity : HIGH (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 4.8 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : HIGH (string)

integrityImpact : NONE (string)

privilegesRequired : LOW (string)

scope : UNCHANGED (string)

userInteraction : REQUIRED (string)

vectorString : CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N (string)

version : 3.1 (string)

}

exploitabilityScore : 1.2 (number)

impactScore : 3.6 (number)

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

published : 2020-02-14T17:15:13.223 (string)

references : [ »

0 : { »

source : psirt@lenovo.com (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://support.lenovo.com/us/en/product_security/LEN-29116 (string)

}

1 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://support.lenovo.com/us/en/product_security/LEN-29116 (string)

}

]

sourceIdentifier : psirt@lenovo.com (string)

vulnStatus : Modified (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-264 (string)

}

]

source : psirt@lenovo.com (string)

type : Secondary (string)

}

1 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-269 (string)

}

]

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

Metrics

Attack Vector Network

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction Required

Access Vector Network

Access Complexity High

Authentication Single

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

Affected Vendors & Products

Metrics

Attack Vector Network

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction Required

Access Vector Network

Access Complexity High

Authentication Single

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object