Unscored CVE-2018-9064 EUVD-2018-20667GHSA-w689-4q7p-cvmx

In Lenovo xClarity Administrator versions earlier than 2.1.0, an authenticated LXCA user may abuse a web API debug call to retrieve the cre…

Published Jul 30, 2018 · Updated Sep 16, 2024 · Assigned by lenovo

Vendor: Lenovo Product: Lenovo XClarity Administrator

Description

In Lenovo xClarity Administrator versions earlier than 2.1.0, an authenticated LXCA user may abuse a web API debug call to retrieve the credentials for the System Manager user.

Affected products

Vendor	Product	Affected	Fixed
Lenovo Group	Lenovo xClarity Administrator	Earlier than 2.1.0	—

References

https://support.lenovo.com/us/en/solutions/LEN-22168