CVE-2024-45104 Missing authorization in XClarity Administrator
Authenticated users with insufficient privileges can modify managed devices via crafted API calls in Lenovo XClarity Administrator.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-45104?
CVE-2024-45104 is a medium-severity missing authorization vulnerability in Lenovo XClarity Administrator, published on 13 Sep 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A valid, authenticated LXCA user without sufficient privileges may be able to use the device identifier to modify an LXCA managed device through a specially crafted web API call.
Weakness: CWE-282
Which versions are affected by CVE-2024-45104?
It affects 1 product.
Products include Lenovo Xclarity Administrator.
How do I fix CVE-2024-45104?
No fix has been published for CVE-2024-45104 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2024-45104 being exploited?
There is no known exploitation of CVE-2024-45104 in the wild and no public exploit code.
Other vulnerabilities in Lenovo XClarity Administrator
- CVE-2016-8233 Information disclosure in XClarity Administrator
- CVE-2018-9064 Information disclosure in Lenovo xClarity Administrator
- CVE-2018-9066 Command injection in Lenovo xClarity Administrator
- CVE-2017-3770 Privilege escalation in Lenovo XClarity Administrator (LXCA)
- CVE-2019-6158 Information disclosure in Lenovo XClarity Administrator
Sources
Also known as GHSA-hwwh-7cg2-3v75.