CVE-2016-8221 Information disclosure in XClarity Administrator (LXCA)
Authenticated users can view log files containing internal administrative passwords, enabling privilege escalation in Lenovo XClarity Administrator.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2016-8221?
CVE-2016-8221 is a high-severity vulnerability in Lenovo Group Ltd. XClarity Administrator (LXCA), published on 12 Jan 2017. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Privilege Escalation in Lenovo XClarity Administrator earlier than 1.2.0, if LXCA is used to manage rack switches or chassis with embedded input/output modules (IOMs), certain log files viewable by authenticated users may contain passwords for internal administrative LXCA accounts with temporary passwords that are used internally by LXCA code.
Weakness: CWE-264
Which versions are affected by CVE-2016-8221?
It affects 1 product.
Products include Lenovo Xclarity Administrator.
How do I fix CVE-2016-8221?
No fix has been published for CVE-2016-8221 yet. Limit exposure of the affected software until one is available.
Is CVE-2016-8221 being exploited?
There is no known exploitation of CVE-2016-8221 in the wild and no public exploit code.
Other vulnerabilities in Lenovo Group Ltd. XClarity Administrator (LXCA)
- CVE-2016-8233 Information disclosure in XClarity Administrator
- CVE-2018-9064 Information disclosure in Lenovo xClarity Administrator
- CVE-2018-9066 Command injection in Lenovo xClarity Administrator
- CVE-2017-3770 Privilege escalation in Lenovo XClarity Administrator (LXCA)
- CVE-2019-6158 Information disclosure in Lenovo XClarity Administrator
Sources
Also known as GHSA-x22w-gfvm-wmxm.