A stored CSV Injection vulnerability was reported in Lenovo XClarity Controller (XCC) that could allow an administrative or other appropriately permissioned user to store malformed data in certain XCC server informational fields, that could result in crafted formulas being stored in an exported CSV file. The crafted formula is not executed on XCC itself and has no effect on the server.
References
| Link | Resource |
|---|---|
| https://support.lenovo.com/solutions/LEN-29118 | Patch Vendor Advisory |
| https://support.lenovo.com/solutions/LEN-29118 | Patch Vendor Advisory |
Configurations
Configuration 1 (hide)
| AND |
|
Configuration 2 (hide)
| AND |
|
Configuration 3 (hide)
| AND |
|
Configuration 4 (hide)
| AND |
|
History
21 Nov 2024, 04:46
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://support.lenovo.com/solutions/LEN-29118 - Patch, Vendor Advisory |
Information
Published : 2019-11-20 02:15
Updated : 2024-11-21 04:46
NVD link : CVE-2019-6187
Mitre link : CVE-2019-6187
CVE.ORG link : CVE-2019-6187
JSON object : View
Products Affected
lenovo
- thinksystem_sr590
- thinksystem_sr530
- thinkagile_7z06
- xclarity_controller
- thinksystem_sr850
- thinksystem_st250
- thinksystem_st558
- thinksystem_sr250
- thinkagile_7d1h
- thinkagile_7y90
- thinkagile_7z04
- thinksystem_sd650
- thinksystem_sn550
- thinkagile_yx84
- _thinksystem_sr670
- thinkagile_7z07
- thinkagile_7z05
- thinksystem_sr550
- thinkagile_7y12
- thinkagile_7z20
- thinksystem_sr150
- thinkagile_7y11
- thinkagile_7y14
- thinksystem_sr258
- thinksystem_sr630
- thinkagile_7x83
- thinksystem_sr950
- thinksystem_st550
- thinkagile_7x82
- thinkagile_7y88
- thinksystem_sr860
- thinkagile_7y93
- thinksystem_st258
- thinkagile_7y92
- thinksystem_sr650
- thinksystem_sr158
- thinksystem_sn850
- thinksystem_sr570
- thinkagile_7z03
- thinksystem_sd530
- thinkagile_7y13
- thinkagile_7y94
CWE
CWE-1236
Improper Neutralization of Formula Elements in a CSV File