CVE-2019-6180 Cross-site scripting in XClarity Administrator (LXCA)
An administrative user can inject stored JavaScript into Lenovo XClarity Administrator, leading to code execution in other users' browsers.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2019-6180?
CVE-2019-6180 is a medium-severity cross-site scripting vulnerability in Lenovo XClarity Administrator (LXCA), published on 3 Sep 2019. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
A stored cross-site scripting (XSS) vulnerability was reported in Lenovo XClarity Administrator (LXCA) versions prior to 2.5.0 that could allow an administrative user to cause JavaScript code to be stored in LXCA which may then be executed in the user's web browser. The JavaScript code is not executed on LXCA itself.
Weakness: CWE-79
Which versions are affected by CVE-2019-6180?
It affects 1 product.
Products include Lenovo Xclarity Administrator.
How do I fix CVE-2019-6180?
No fix has been published for CVE-2019-6180 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2019-6180 being exploited?
There is no known exploitation of CVE-2019-6180 in the wild and no public exploit code.
Other vulnerabilities in Lenovo XClarity Administrator (LXCA)
- CVE-2016-8233 Information disclosure in XClarity Administrator
- CVE-2018-9064 Information disclosure in Lenovo xClarity Administrator
- CVE-2018-9066 Command injection in Lenovo xClarity Administrator
- CVE-2017-3770 Privilege escalation in Lenovo XClarity Administrator (LXCA)
- CVE-2019-6158 Information disclosure in Lenovo XClarity Administrator
Sources
Also known as GHSA-pwj3-9jf6-77cr.