CVE-2019-6177 Path traversal in Solution Center
Attackers can exploit log file writing flaws in Lenovo Solution Center to achieve privilege escalation; users should migrate to supported alternatives.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-6177?
CVE-2019-6177 is a high-severity path traversal vulnerability in Lenovo Solution Center, published on 21 Aug 2019. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A vulnerability reported in Lenovo Solution Center version 03.12.003, which is no longer supported, could allow log files to be written to non-standard locations, potentially leading to privilege escalation. Lenovo ended support for Lenovo Solution Center and recommended that customers migrate to Lenovo Vantage or Lenovo Diagnostics in April 2018.
Weakness: CWE-200
Which versions are affected by CVE-2019-6177?
It affects 1 product.
Products include Lenovo Solution Center.
How do I fix CVE-2019-6177?
No fix has been published for CVE-2019-6177 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2019-6177 being exploited?
There is no known exploitation of CVE-2019-6177 in the wild and no public exploit code.
Other vulnerabilities in Lenovo Solution Center
- CVE-2015-8536 Cross-site request forgery in n/a
- CVE-2015-8534 Privilege escalation in n/a
- CVE-2015-8535 Path traversal in n/a
- CVE-2016-1876 The backend service process in Lenovo Solution Center (aka LSC) before 3.3.0002 allows local users to gain SYSTEM privileges via unspecified vectors.
- CVE-2016-5249 Privilege escalation in n/a
Sources
Also known as GHSA-4432-q79g-625v.