CVE-2019-6195
Summary
| CVE | CVE-2019-6195 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2020-02-14 17:15:00 UTC |
| Updated | 2020-03-04 18:26:00 UTC |
| Description | An authorization bypass exists in Lenovo XClarity Controller (XCC) versions prior to 3.08 CDI340V, 3.01 TEI392O, 1.71 PSI328N where a valid authenticated user with lesser privileges may be granted read-only access to higher-privileged information if 1) “LDAP Authentication Only with Local Authorization” mode is configured and used by XCC, and 2) a lesser privileged user logs into XCC within 1 minute of a higher privileged user logging out. The authorization bypass does not exist when “Local Authentication and Authorization” or “LDAP Authentication and Authorization” modes are configured and used by XCC. |
Risk And Classification
Problem Types: CWE-269
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Hardware | Lenovo | Thinkagile Hx 1000 | - | All | All | All |
| Hardware | Lenovo | Thinkagile Hx 1000 | - | All | All | All |
| Hardware | Lenovo | Thinkagile Hx 2000 | - | All | All | All |
| Hardware | Lenovo | Thinkagile Hx 2000 | - | All | All | All |
| Hardware | Lenovo | Thinkagile Hx 3000 | - | All | All | All |
| Hardware | Lenovo | Thinkagile Hx 3000 | - | All | All | All |
| Hardware | Lenovo | Thinkagile Hx 5000 | - | All | All | All |
| Hardware | Lenovo | Thinkagile Hx 5000 | - | All | All | All |
| Hardware | Lenovo | Thinkagile Hx 7000 | - | All | All | All |
| Hardware | Lenovo | Thinkagile Hx 7000 | - | All | All | All |
| Hardware | Lenovo | Thinkagile Mx Sr650 | - | All | All | All |
| Hardware | Lenovo | Thinkagile Mx Sr650 | - | All | All | All |
| Hardware | Lenovo | Thinkagile Vx 1000 | - | All | All | All |
| Hardware | Lenovo | Thinkagile Vx 1000 | - | All | All | All |
| Hardware | Lenovo | Thinkagile Vx 2000 | - | All | All | All |
| Hardware | Lenovo | Thinkagile Vx 2000 | - | All | All | All |
| Hardware | Lenovo | Thinkagile Vx 3000 | - | All | All | All |
| Hardware | Lenovo | Thinkagile Vx 3000 | - | All | All | All |
| Hardware | Lenovo | Thinkagile Vx 5000 | - | All | All | All |
| Hardware | Lenovo | Thinkagile Vx 5000 | - | All | All | All |
| Hardware | Lenovo | Thinkagile Vx 7000 | - | All | All | All |
| Hardware | Lenovo | Thinkagile Vx 7000 | - | All | All | All |
| Hardware | Lenovo | Thinksystem Sd530 | - | All | All | All |
| Hardware | Lenovo | Thinksystem Sd530 | - | All | All | All |
| Hardware | Lenovo | Thinksystem Sd650 Dwc | - | All | All | All |
| Hardware | Lenovo | Thinksystem Sd650 Dwc | - | All | All | All |
| Hardware | Lenovo | Thinksystem Sn550 | - | All | All | All |
| Hardware | Lenovo | Thinksystem Sn550 | - | All | All | All |
| Hardware | Lenovo | Thinksystem Sn850 | - | All | All | All |
| Hardware | Lenovo | Thinksystem Sn850 | - | All | All | All |
| Hardware | Lenovo | Thinksystem Sr150 | - | All | All | All |
| Hardware | Lenovo | Thinksystem Sr150 | - | All | All | All |
| Hardware | Lenovo | Thinksystem Sr158 | - | All | All | All |
| Hardware | Lenovo | Thinksystem Sr158 | - | All | All | All |
| Hardware | Lenovo | Thinksystem Sr250 | - | All | All | All |
| Hardware | Lenovo | Thinksystem Sr250 | - | All | All | All |
| Hardware | Lenovo | Thinksystem Sr258 | - | All | All | All |
| Hardware | Lenovo | Thinksystem Sr258 | - | All | All | All |
| Hardware | Lenovo | Thinksystem Sr530 | - | All | All | All |
| Hardware | Lenovo | Thinksystem Sr530 | - | All | All | All |
| Hardware | Lenovo | Thinksystem Sr550 | - | All | All | All |
| Hardware | Lenovo | Thinksystem Sr550 | - | All | All | All |
| Hardware | Lenovo | Thinksystem Sr570 | - | All | All | All |
| Hardware | Lenovo | Thinksystem Sr570 | - | All | All | All |
| Hardware | Lenovo | Thinksystem Sr590 | - | All | All | All |
| Hardware | Lenovo | Thinksystem Sr590 | - | All | All | All |
| Hardware | Lenovo | Thinksystem Sr630 | - | All | All | All |
| Hardware | Lenovo | Thinksystem Sr630 | - | All | All | All |
| Hardware | Lenovo | Thinksystem Sr650 | - | All | All | All |
| Hardware | Lenovo | Thinksystem Sr650 | - | All | All | All |
| Hardware | Lenovo | Thinksystem Sr850 | - | All | All | All |
| Hardware | Lenovo | Thinksystem Sr850 | - | All | All | All |
| Hardware | Lenovo | Thinksystem Sr860 | - | All | All | All |
| Hardware | Lenovo | Thinksystem Sr860 | - | All | All | All |
| Hardware | Lenovo | Thinksystem Sr950 Server | - | All | All | All |
| Hardware | Lenovo | Thinksystem Sr950 Server | - | All | All | All |
| Hardware | Lenovo | Thinksystem St250 | - | All | All | All |
| Hardware | Lenovo | Thinksystem St250 | - | All | All | All |
| Hardware | Lenovo | Thinksystem St258 | - | All | All | All |
| Hardware | Lenovo | Thinksystem St258 | - | All | All | All |
| Hardware | Lenovo | Thinksystem St550 | - | All | All | All |
| Hardware | Lenovo | Thinksystem St550 | - | All | All | All |
| Hardware | Lenovo | Thinksystem St558 | - | All | All | All |
| Hardware | Lenovo | Thinksystem St558 | - | All | All | All |
| Application | Lenovo | Xclarity Controller | All | All | All | All |
| Application | Lenovo | Xclarity Controller | All | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Lenovo XClarity Controller (XCC) Vulnerability - Lenovo Support US | CONFIRM | support.lenovo.com | Vendor Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.