CVE-2021-3417

An internal product security audit of LXCO, prior to version 1.2.2, discovered that credentials for Lenovo XClarity Administrator (LXCA), if added as a Resource Manager, are encoded then written to an internal LXCO log file each time a session is established with LXCA. Affected logs are captured in the First Failure Data Capture (FFDC) service log. The FFDC service log is only generated when requested by a privileged LXCO user and it is only accessible to the privileged LXCO user that requested the file.

CVSS v3 4.9 MEDIUM
CVSS v2.0 4.0 MEDIUM

4.9^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.2 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

4.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:S/C:P/I:N/A:N

Exploitability : 8.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://support.lenovo.com/us/en/product_security/LEN-49884	Vendor Advisory
https://support.lenovo.com/us/en/product_security/LEN-49884	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:lenovo:xclarity_orchestrator:*:*:*:*:*:*:*:*

History

21 Nov 2024, 06:21

Type	Values Removed	Values Added
References	~~() https://support.lenovo.com/us/en/product_security/LEN-49884 - Vendor Advisory~~	() https://support.lenovo.com/us/en/product_security/LEN-49884 - Vendor Advisory

Information

Published : 2021-03-09 17:15

Updated : 2024-11-21 06:21

NVD link : CVE-2021-3417

Mitre link : CVE-2021-3417

CVE.ORG link : CVE-2021-3417

JSON object : View

Products Affected

lenovo

xclarity_orchestrator

CWE

CWE-319

Cleartext Transmission of Sensitive Information

{"id": "CVE-2021-3417", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "authentication": "SINGLE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@lenovo.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.2}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.2}]}, "published": "2021-03-09T17:15:12.923", "references": [{"url": "https://support.lenovo.com/us/en/product_security/LEN-49884", "tags": ["Vendor Advisory"], "source": "psirt@lenovo.com"}, {"url": "https://support.lenovo.com/us/en/product_security/LEN-49884", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "psirt@lenovo.com", "description": [{"lang": "en", "value": "CWE-319"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-319"}]}], "descriptions": [{"lang": "en", "value": "An internal product security audit of LXCO, prior to version 1.2.2, discovered that credentials for Lenovo XClarity Administrator (LXCA), if added as a Resource Manager, are encoded then written to an internal LXCO log file each time a session is established with LXCA. Affected logs are captured in the First Failure Data Capture (FFDC) service log. The FFDC service log is only generated when requested by a privileged LXCO user and it is only accessible to the privileged LXCO user that requested the file."}, {"lang": "es", "value": "Una auditor\u00eda de seguridad de producto interna de LXCO, versiones anteriores a 1.2.2, detect\u00f3 que las credenciales para Lenovo XClarity Administrator (LXCA), si se agregan como Administrador de Recursos, son codificadas y luego se escriben en un archivo de registro interno de LXCO cada vez que es establecida una sesi\u00f3n con LXCA. Los registros afectados son capturados en el registro del servicio First Failure Data Capture (FFDC). El registro de servicio FFDC solo es generado cuando lo pide un usuario LXCO privilegiado y solo es accesible para el usuario LXCO privilegiado que pidi\u00f3 el archivo"}], "lastModified": "2024-11-21T06:21:27.430", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:lenovo:xclarity_orchestrator:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FECA5D80-C79E-41CD-B2CA-F82BE021D384", "versionEndExcluding": "1.2.2"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@lenovo.com"}