CVE-2019-19757 Cross-site scripting in XClarity Administrator (LXCA)

Medium 5.4 Published 14 Feb 2020 Updated 16 Sep 2024

An attacker can execute arbitrary JavaScript in a user's browser via a crafted link in Lenovo XClarity Administrator.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2019-19757?

CVE-2019-19757 is a medium-severity cross-site scripting vulnerability in Lenovo XClarity Administrator (LXCA), published on 14 Feb 2020. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

An internal product security audit of Lenovo XClarity Administrator (LXCA) discovered a Document Object Model (DOM) based cross-site scripting vulnerability in versions prior to 2.6.6 that could allow JavaScript code to be executed in the user's web browser if a specially crafted link is visited. The JavaScript code is executed on the user's system, not executed on LXCA itself.

Weakness: CWE-79

Which versions are affected by CVE-2019-19757?

It affects 1 product.

Products include Lenovo Xclarity Administrator.

How do I fix CVE-2019-19757?

No fix has been published for CVE-2019-19757 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2019-19757 being exploited?

There is no known exploitation of CVE-2019-19757 in the wild and no public exploit code.

Sources

Also known as GHSA-gv24-vhxm-xr5j.