CVE-2019-6195
Description
An authorization bypass exists in Lenovo XClarity Controller (XCC) versions prior to 3.08 CDI340V, 3.01 TEI392O, 1.71 PSI328N where a valid authenticated user with lesser privileges may be granted read-only access to higher-privileged information if 1) “LDAP Authentication Only with Local Authorization” mode is configured and used by XCC, and 2) a lesser privileged user logs into XCC within 1 minute of a higher privileged user logging out. The authorization bypass does not exist when “Local Authentication and Authorization” or “LDAP Authentication and Authorization” modes are configured and used by XCC.
How to fix
- lenovo xclarity_controller3.01_tei392o, 3.08_cdi340v, 1.71_psi328n or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| lenovo xclarity_controller | v < 3.01_tei392o, v < 3.08_cdi340v, v < 1.71_psi328n | 3.01_tei392o, 3.08_cdi340v, 1.71_psi328n |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.