CVE-2024-45103 Missing authorization in XClarity Administrator
Authenticated users can unmanage devices without sufficient privileges, allowing unauthorized administrative actions in Lenovo XClarity Administrator.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-45103?
CVE-2024-45103 is a medium-severity missing authorization vulnerability in Lenovo XClarity Administrator, published on 13 Sep 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A valid, authenticated LXCA user may be able to unmanage an LXCA managed device in through the LXCA web interface without sufficient privileges.
Weakness: CWE-282
Which versions are affected by CVE-2024-45103?
It affects 1 product.
Products include Lenovo Xclarity Administrator.
How do I fix CVE-2024-45103?
No fix has been published for CVE-2024-45103 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2024-45103 being exploited?
There is no known exploitation of CVE-2024-45103 in the wild and no public exploit code.
Other vulnerabilities in Lenovo XClarity Administrator
- CVE-2016-8233 Information disclosure in XClarity Administrator
- CVE-2018-9064 Information disclosure in Lenovo xClarity Administrator
- CVE-2018-9066 Command injection in Lenovo xClarity Administrator
- CVE-2017-3770 Privilege escalation in Lenovo XClarity Administrator (LXCA)
- CVE-2019-6158 Information disclosure in Lenovo XClarity Administrator
Sources
Also known as GHSA-p5f6-v7vq-6742.