CVE-2024-45101 — Cleartext Transmission of Sensitive Info in Lenovo Xclarity Administrator

CWE-319 — Cleartext Transmission of Sensitive Info3 documents3 sources

Severity

6.8MEDIUMNVD

EPSS

0.1%

top 66.15%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Lenovo Xclarity Administrator

Timeline

PublishedSep 13

Description

A privilege escalation vulnerability was discovered when Single Sign On (SSO) is enabled that could allow an attacker to intercept a valid, authenticated LXCA user’s XCC session if they can convince the user to click on a specially crafted URL.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:NExploitability: 1.6 | Impact: 5.2

Affected Packages1 packages

▶CVEListV5lenovo/xclarity_administrator< 4.1

🔴Vulnerability Details

GHSA

GHSA-9rrr-65q4-qrrq: A privilege escalation vulnerability was discovered when Single Sign On (SSO) is enabled that could allow an attacker to intercept a valid, authentica↗2024-09-13

▶

CVEList

CVE-2024-45101: A privilege escalation vulnerability was discovered when Single Sign On (SSO) is enabled that could allow an attacker to intercept a valid, authentica↗2024-09-13

▶