Vulnerabilites related to lenovo - thinkagile_7z03
cve-2019-6187
Vulnerability from cvelistv5
Published
2019-11-20 01:31
Modified
2024-09-17 00:50
Severity ?
Summary
A stored CSV Injection vulnerability was reported in Lenovo XClarity Controller (XCC) that could allow an administrative or other appropriately permissioned user to store malformed data in certain XCC server informational fields, that could result in crafted formulas being stored in an exported CSV file. The crafted formula is not executed on XCC itself and has no effect on the server.
References
Impacted products
Vendor Product Version
Lenovo Lenovo XClarity Controller (XCC) Version: unspecified   < TEI392M
Version: unspecified   < CDI340M
Version: unspecified   < G1I312
Version: unspecified   < PSI328M
Show details on NVD website


{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-04T20:16:24.496Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://support.lenovo.com/solutions/LEN-29118",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "Lenovo XClarity Controller (XCC)",
               vendor: "Lenovo",
               versions: [
                  {
                     lessThan: "TEI392M",
                     status: "affected",
                     version: "unspecified",
                     versionType: "custom",
                  },
                  {
                     lessThan: "CDI340M",
                     status: "affected",
                     version: "unspecified",
                     versionType: "custom",
                  },
                  {
                     lessThan: "G1I312",
                     status: "affected",
                     version: "unspecified",
                     versionType: "custom",
                  },
                  {
                     lessThan: "PSI328M",
                     status: "affected",
                     version: "unspecified",
                     versionType: "custom",
                  },
               ],
            },
         ],
         datePublic: "2019-11-19T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "A stored CSV Injection vulnerability was reported in Lenovo XClarity Controller (XCC) that could allow an administrative or other appropriately permissioned user to store malformed data in certain XCC server informational fields, that could result in crafted formulas being stored in an exported CSV file. The crafted formula is not executed on XCC itself and has no effect on the server.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "arbitrary eode execution",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2019-11-20T01:31:13",
            orgId: "da227ddf-6e25-4b41-b023-0f976dcaca4b",
            shortName: "lenovo",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://support.lenovo.com/solutions/LEN-29118",
            },
         ],
         solutions: [
            {
               lang: "en",
               value: "Update LXCC to the version indicated for your product.",
            },
         ],
         source: {
            advisory: "LEN-29118",
            discovery: "UNKNOWN",
         },
         x_generator: {
            engine: "Vulnogram 0.0.8",
         },
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "psirt@lenovo.com",
               DATE_PUBLIC: "2019-11-19T17:00:00.000Z",
               ID: "CVE-2019-6187",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "Lenovo XClarity Controller (XCC)",
                                 version: {
                                    version_data: [
                                       {
                                          affected: "<",
                                          version_affected: "<",
                                          version_value: "TEI392M",
                                       },
                                       {
                                          version_affected: "<",
                                          version_value: "CDI340M",
                                       },
                                       {
                                          version_affected: "<",
                                          version_value: "G1I312",
                                       },
                                       {
                                          version_affected: "<",
                                          version_value: "PSI328M",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "Lenovo",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "A stored CSV Injection vulnerability was reported in Lenovo XClarity Controller (XCC) that could allow an administrative or other appropriately permissioned user to store malformed data in certain XCC server informational fields, that could result in crafted formulas being stored in an exported CSV file. The crafted formula is not executed on XCC itself and has no effect on the server.",
                  },
               ],
            },
            generator: {
               engine: "Vulnogram 0.0.8",
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "arbitrary eode execution",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://support.lenovo.com/solutions/LEN-29118",
                     refsource: "MISC",
                     url: "https://support.lenovo.com/solutions/LEN-29118",
                  },
               ],
            },
            solution: [
               {
                  lang: "en",
                  value: "Update LXCC to the version indicated for your product.",
               },
            ],
            source: {
               advisory: "LEN-29118",
               discovery: "UNKNOWN",
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "da227ddf-6e25-4b41-b023-0f976dcaca4b",
      assignerShortName: "lenovo",
      cveId: "CVE-2019-6187",
      datePublished: "2019-11-20T01:31:13.802773Z",
      dateReserved: "2019-01-11T00:00:00",
      dateUpdated: "2024-09-17T00:50:51.427Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

Vulnerability from fkie_nvd
Published
2019-11-20 02:15
Modified
2024-11-21 04:46
Summary
A stored CSV Injection vulnerability was reported in Lenovo XClarity Controller (XCC) that could allow an administrative or other appropriately permissioned user to store malformed data in certain XCC server informational fields, that could result in crafted formulas being stored in an exported CSV file. The crafted formula is not executed on XCC itself and has no effect on the server.



{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:lenovo:xclarity_controller:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "2DEA7654-0593-4CEA-9040-078D4801C871",
                     versionEndExcluding: "tei392m",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:h:lenovo:thinkagile_7x82:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "6C022FCB-ECB4-4E33-84E9-28E97AF1C21F",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:lenovo:thinkagile_7y11:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "3A1B8C35-DF16-4D29-AF9E-01339AC9BED4",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:lenovo:thinkagile_7y12:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "99BA98D3-E3A9-49A0-9B0E-967B9126675B",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:lenovo:thinkagile_7y88:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "D51EBEBE-ADB7-48C3-9848-E3203333F2FE",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:lenovo:thinkagile_7y92:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "E914E260-382D-4CD0-BCE1-D960DAA30E05",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:lenovo:thinkagile_7z03:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "B8279AC5-03B1-44D6-8C9B-989F2C281641",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:lenovo:thinksystem_sd530:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "2588DA2E-6E58-4FA2-9AA6-FC669C042197",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:lenovo:thinksystem_sd650:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "7A1FF5D0-CC08-42B0-9798-55ED911B3EF6",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:lenovo:thinksystem_sn550:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "5DB64709-93BA-43D8-A1DB-4CE405291430",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:lenovo:thinksystem_sn850:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "1DB0C393-2CB4-485F-93E2-2F28B19F9325",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:lenovo:thinksystem_sr150:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "C6334030-07E4-45F4-A233-4A37F77FC573",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:lenovo:thinksystem_sr158:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "D94182EE-10FE-4506-BDE0-06F4140923FC",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:lenovo:thinksystem_sr250:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "C5B52AC1-714E-4217-8599-80D99E0D33B3",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:lenovo:thinksystem_sr258:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "DB19D273-4975-4957-AE94-117B607CD746",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:lenovo:thinksystem_sr850:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "19771143-D5F1-4F2F-AB83-09913894681E",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:lenovo:thinksystem_sr860:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "EAF08144-ECCB-477B-A934-E4578522BFEE",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:lenovo:thinksystem_st250:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "DBF2350D-34B1-44DB-8E4A-6F29B37D96CF",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:lenovo:thinksystem_st258:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "089F97B1-FEDE-4A5D-91D3-0517E8D39174",
                     vulnerable: false,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
         operator: "AND",
      },
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:lenovo:xclarity_controller:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "C03E8D97-6337-4E22-8125-8CED65281D5C",
                     versionEndExcluding: "cdi340m",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:h:lenovo:thinkagile_7d1h:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "0BCA03A8-09C3-47A3-9715-D869B848771B",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:lenovo:thinkagile_7x83:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "D84E8645-BDEA-4DBD-972B-FFEEBD6EEA85",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:lenovo:thinkagile_7y13:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "B39D9ADA-4F3C-43A6-902F-E6626BC692F9",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:lenovo:thinkagile_7y14:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "7FB46A9B-16D9-4D4C-9BE1-813452C51C11",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:lenovo:thinkagile_7y90:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "31DAB6CE-B360-489B-93DF-F98C4DE85DFE",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:lenovo:thinkagile_7y93:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "634E0104-AD3D-48A3-B0E0-A74C15FAACC7",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:lenovo:thinkagile_7y94:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "B0B0F1CD-A017-4C20-AEB9-F80BA7FF304B",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:lenovo:thinkagile_7z04:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "871F4EE6-3E47-499E-9650-47AB35EBBD9E",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:lenovo:thinkagile_7z05:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "29D7C95C-F43D-4A1A-BD8B-5F40D8003477",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:lenovo:thinkagile_7z06:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "792A1744-DFC1-420D-BFD5-60AE54DA54CC",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:lenovo:thinkagile_7z07:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "6F814B1C-E4E4-48BA-92C4-39B7997B51F4",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:lenovo:thinkagile_7z20:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "40516AAC-4F19-4AE8-9C0B-0697D36FB0F9",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:lenovo:thinkagile_yx84:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "6876F1AA-3196-4576-B8F4-202266DA64EF",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:lenovo:thinksystem_sr530:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "F4C6628A-8A99-4841-A7C5-0445A03C638D",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:lenovo:thinksystem_sr550:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "D10850BF-A7EA-4B84-B2EF-66DCCC301514",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:lenovo:thinksystem_sr570:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "8A7C5BE3-5429-46B0-B0B5-C86A9B6376A7",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:lenovo:thinksystem_sr590:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "A3DC615C-A88A-4C45-892F-77C5E84104E8",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:lenovo:thinksystem_sr630:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "D7F10C8D-C9C7-4FAD-980D-7A602C8BE81D",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:lenovo:thinksystem_sr650:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "C6C2B5BB-6E1F-4E01-AAE8-A8239AB8945E",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:lenovo:thinksystem_st550:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "A5B19107-5B45-4E45-8B34-90B5A1FF3962",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:lenovo:thinksystem_st558:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "30CFA6D5-7D07-4BFF-8AD2-DE591EDE0186",
                     vulnerable: false,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
         operator: "AND",
      },
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:lenovo:xclarity_controller:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "D93ED5C3-F8AF-4793-8CD5-2795EDE1CC04",
                     versionEndExcluding: "g1i312",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:h:lenovo:_thinksystem_sr670:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "158A1ED4-96CD-4F8B-B607-6AC5AF12E057",
                     vulnerable: false,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
         operator: "AND",
      },
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:lenovo:xclarity_controller:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "AB970505-71D1-4802-8D9F-6D81A4024470",
                     versionEndExcluding: "psi328m",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:h:lenovo:thinksystem_sr950:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "B6B0407D-D603-48AE-9A42-F4C68056E19D",
                     vulnerable: false,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
         operator: "AND",
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "A stored CSV Injection vulnerability was reported in Lenovo XClarity Controller (XCC) that could allow an administrative or other appropriately permissioned user to store malformed data in certain XCC server informational fields, that could result in crafted formulas being stored in an exported CSV file. The crafted formula is not executed on XCC itself and has no effect on the server.",
      },
      {
         lang: "es",
         value: "Se reportó una vulnerabilidad de inyección CSV almacenada en Lenovo XClarity Controller (XCC) lo que podría permitir a un usuario administrativo u otro usuario con permiso apropiado almacenar datos malformados en determinados campos informativos del servidor de XCC, que podría resultar en que las fórmulas especialmente diseñadas sean almacenadas en un archivo CSV exportado. La fórmula especialmente diseñada no es ejecutada en XCC y no tiene ningún efecto en el servidor.",
      },
   ],
   id: "CVE-2019-6187",
   lastModified: "2024-11-21T04:46:07.577",
   metrics: {
      cvssMetricV2: [
         {
            acInsufInfo: false,
            baseSeverity: "MEDIUM",
            cvssData: {
               accessComplexity: "LOW",
               accessVector: "NETWORK",
               authentication: "SINGLE",
               availabilityImpact: "NONE",
               baseScore: 4,
               confidentialityImpact: "PARTIAL",
               integrityImpact: "NONE",
               vectorString: "AV:N/AC:L/Au:S/C:P/I:N/A:N",
               version: "2.0",
            },
            exploitabilityScore: 8,
            impactScore: 2.9,
            obtainAllPrivilege: false,
            obtainOtherPrivilege: false,
            obtainUserPrivilege: false,
            source: "nvd@nist.gov",
            type: "Primary",
            userInteractionRequired: false,
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "NONE",
               baseScore: 6.5,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "HIGH",
               integrityImpact: "NONE",
               privilegesRequired: "LOW",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
               version: "3.1",
            },
            exploitabilityScore: 2.8,
            impactScore: 3.6,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2019-11-20T02:15:10.787",
   references: [
      {
         source: "psirt@lenovo.com",
         tags: [
            "Patch",
            "Vendor Advisory",
         ],
         url: "https://support.lenovo.com/solutions/LEN-29118",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Patch",
            "Vendor Advisory",
         ],
         url: "https://support.lenovo.com/solutions/LEN-29118",
      },
   ],
   sourceIdentifier: "psirt@lenovo.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-1236",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}