Skip to content
OpenAdvisories
Medium · 4.9 CVE-2021-3417 EUVD-2021-26745GHSA-f2gj-pfpv-hh8v

An internal product security audit of LXCO, prior to version 1.2.2, discovered that credentials for Lenovo XClarity Administrator (LXCA), i…

Published Mar 9, 2021 · Updated Sep 16, 2024 · Assigned by lenovo

Description

An internal product security audit of LXCO, prior to version 1.2.2, discovered that credentials for Lenovo XClarity Administrator (LXCA), if added as a Resource Manager, are encoded then written to an internal LXCO log file each time a session is established with LXCA. Affected logs are captured in the First Failure Data Capture (FFDC) service log. The FFDC service log is only generated when requested by a privileged LXCO user and it is only accessible to the privileged LXCO user that requested the file.

Affected products

VendorProductAffectedFixed
Lenovo XClarity Orchestrator unspecified – < 1.2.2 1.2.2

References