CVE-2021-3473: Medium severity Lenovo XClarity Controller vulnerability
An internal product security audit of Lenovo XClarity Controller (XCC) discovered that the XCC configuration backup/restore password may be written to an internal XCC log buffer if Lenovo XClarity Administrator (LXCA) is used to perform the backup/restore. The backup/restore password typically exists in this internal log buffer for less than 10 minutes before being overwritten. Generating an FFDC service log will include the log buffer contents, including the backup/restore password if present. The FFDC service log is only generated when requested by a privileged XCC user and it is only accessible to the privileged XCC user that requested the file. The backup/restore password is not captured if the backup/restore is initiated directly from XCC.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Lenovo XClarity Controller (XCC)to a version that resolves this vulnerability.Patch LEN-52117
Event History
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2021-3473.
What is the severity of CVE-2021-3473?
The severity of CVE-2021-3473 is medium with a severity value of 4.9.
What software is affected by CVE-2021-3473?
The Lenovo XClarity Controller version 6.00_cdi370q is affected by CVE-2021-3473.
How can the vulnerability in Lenovo XClarity Controller be exploited?
The vulnerability in Lenovo XClarity Controller can be exploited by writing the configuration backup/restore password to an internal XCC log buffer if Lenovo XClarity Administrator (LXCA) is used to perform the backup/restore.
How can I fix CVE-2021-3473?
To fix CVE-2021-3473, it is recommended to apply the necessary patches or updates provided by Lenovo.