If multiple users are concurrently logged into a single system where one user is sending a command via the Lenovo ToolsCenter Advanced Settings Utility (ASU), UpdateXpress System Pack Installer (UXSPI) or Dynamic System Analysis (DSA) to a second machine, the other users may be able to see the user ID and clear text password that were used to access the second machine during the time the command is processing.
References
Link | Resource |
---|---|
https://support.lenovo.com/us/en/product_security/LEN-10810 | Patch Vendor Advisory |
https://support.lenovo.com/us/en/product_security/LEN-10810 | Patch Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 03:26
Type | Values Removed | Values Added |
---|---|---|
References | () https://support.lenovo.com/us/en/product_security/LEN-10810 - Patch, Vendor Advisory |
Information
Published : 2017-06-20 00:29
Updated : 2024-11-21 03:26
NVD link : CVE-2017-3743
Mitre link : CVE-2017-3743
CVE.ORG link : CVE-2017-3743
JSON object : View
Products Affected
lenovo
- updatexpress_system_pack_installer
- advanced_settings_utility
- toolscenter_dynamic_system_analysis
CWE
CWE-200
Exposure of Sensitive Information to an Unauthorized Actor