CVE-2020-8356

An internal product security audit of LXCO, prior to version 1.2.2, discovered that optional passwords, if specified, for the Syslog and SMTP forwarders are written to an internal LXCO log file in clear text. Affected logs are captured in the First Failure Data Capture (FFDC) service log. The FFDC service log is only generated when requested by a privileged LXCO user and it is only accessible to the privileged LXCO user that requested the file.

CVSS v3 4.9 MEDIUM
CVSS v2.0 4.0 MEDIUM

4.9^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.2 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

4.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:S/C:P/I:N/A:N

Exploitability : 8.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://support.lenovo.com/us/en/product_security/LEN-49884	Vendor Advisory
https://support.lenovo.com/us/en/product_security/LEN-49884	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:lenovo:xclarity_orchestrator:*:*:*:*:*:*:*:*

History

21 Nov 2024, 05:38

Type	Values Removed	Values Added
References	~~() https://support.lenovo.com/us/en/product_security/LEN-49884 - Vendor Advisory~~	() https://support.lenovo.com/us/en/product_security/LEN-49884 - Vendor Advisory

Information

Published : 2021-03-09 17:15

Updated : 2024-11-21 05:38

NVD link : CVE-2020-8356

Mitre link : CVE-2020-8356

CVE.ORG link : CVE-2020-8356

JSON object : View

Products Affected

lenovo

xclarity_orchestrator

CWE

CWE-319

Cleartext Transmission of Sensitive Information

{"id": "CVE-2020-8356", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "authentication": "SINGLE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@lenovo.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.2}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.2}]}, "published": "2021-03-09T17:15:12.453", "references": [{"url": "https://support.lenovo.com/us/en/product_security/LEN-49884", "tags": ["Vendor Advisory"], "source": "psirt@lenovo.com"}, {"url": "https://support.lenovo.com/us/en/product_security/LEN-49884", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "psirt@lenovo.com", "description": [{"lang": "en", "value": "CWE-319"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-319"}]}], "descriptions": [{"lang": "en", "value": "An internal product security audit of LXCO, prior to version 1.2.2, discovered that optional passwords, if specified, for the Syslog and SMTP forwarders are written to an internal LXCO log file in clear text. Affected logs are captured in the First Failure Data Capture (FFDC) service log. The FFDC service log is only generated when requested by a privileged LXCO user and it is only accessible to the privileged LXCO user that requested the file."}, {"lang": "es", "value": "Una auditor\u00eda de seguridad de producto interna de LXCO, versiones anteriores a 1.2.2, detect\u00f3 que las contrase\u00f1as opcionales, si se especifican, para los reenviadores Syslog y SMTP son escritas en un archivo de registro interno de LXCO en texto sin cifrar. Unos registros afectados son capturados en el registro del servicio First Failure Data Capture (FFDC). El registro de servicio FFDC solo se genera cuando lo pide un usuario LXCO privilegiado y solo es accesible para el usuario LXCO privilegiado que pidi\u00f3 el archivo"}], "lastModified": "2024-11-21T05:38:46.397", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:lenovo:xclarity_orchestrator:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FECA5D80-C79E-41CD-B2CA-F82BE021D384", "versionEndExcluding": "1.2.2"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@lenovo.com"}