CVE-2019-19756: High severity Lenovo XClarity Administrator vulnerability

Published Mar 13, 2020

Updated

An internal product security audit of Lenovo XClarity Administrator (LXCA) discovered Windows OS credentials, used to perform driver updates of managed systems, being written to a log file in clear text. This only affects LXCA version 2.6.0 when performing a Windows driver update. Affected logs are only accessible to authorized users in the First Failure Data Capture (FFDC) service log and log files on LXCA.

Affected Software

1 affected component

Lenovo XClarity Administrator=2.6.0

Remediation

Information

Update your LXCA installation to version 2.6.12 or later. Installation note: You will need to update to LXCA 2.6.0 before installing the latest fix bundle (v 2.6.12).

Event History

Mar 13, 2020

CVE Published

via MITRE·03:40 PM

Data Sourced

via MITRE·03:40 PM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

What is CVE-2019-19756?

CVE-2019-19756 is a vulnerability discovered in Lenovo XClarity Administrator (LXCA) version 2.6.0, where Windows OS credentials used for driver updates are logged in clear text.

How does CVE-2019-19756 affect LXCA?

CVE-2019-19756 affects LXCA version 2.6.0 when performing a Windows driver update by logging the Windows OS credentials in clear text.

What is the severity level of CVE-2019-19756?

CVE-2019-19756 has a severity level of high.

How can I fix CVE-2019-19756?

To fix CVE-2019-19756, users should update to a version of LXCA that addresses the vulnerability.

Where can I find more information about CVE-2019-19756?

More information about CVE-2019-19756 can be found at the following link: <https://support.lenovo.com/us/en/product_security/LEN-29942>