If multiple users are concurrently logged into a single system where one user is sending a command via the Lenovo ToolsCenter Advanced Settings Utility (ASU), UpdateXpress System Pack Installer (UXSPI) or Dynamic System Analysis (DSA) to a second machine, the other users may be able to see the user ID and clear text password that were used to access the second machine during the time the command is processing.
References
Link | Resource |
---|---|
https://support.lenovo.com/us/en/product_security/LEN-10810 | Patch Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
No history.
Information
Published : 2017-06-20 00:29
Updated : 2024-02-28 16:04
NVD link : CVE-2017-3743
Mitre link : CVE-2017-3743
CVE.ORG link : CVE-2017-3743
JSON object : View
Products Affected
lenovo
- updatexpress_system_pack_installer
- advanced_settings_utility
- toolscenter_dynamic_system_analysis
CWE
CWE-200
Exposure of Sensitive Information to an Unauthorized Actor