cvelistv5 - cve-2024-45101

CVE-2024-45101 (GCVE-0-2024-45101)

Vulnerability from cvelistv5 – Published: 2024-09-13 17:27 – Updated: 2024-09-13 17:50

Summary

A privilege escalation vulnerability was discovered when Single Sign On (SSO) is enabled that could allow an attacker to intercept a valid, authenticated LXCA user’s XCC session if they can convince the user to click on a specially crafted URL.

Severity ?

6.8 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

CWE

CWE-319 - Cleartext Transmission of Sensitive Information

Assigner

lenovo

References

URL

Tags

https://support.lenovo.com/us/en/product_security…

Impacted products

	Vendor	Product	Version
	Lenovo	XClarity Administrator	Affected: 0 , < 4.1 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:lenovo:xclarity_administrator:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "xclarity_administrator",
            "vendor": "lenovo",
            "versions": [
              {
                "lessThan": "4.1",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-45101",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-13T17:49:37.744521Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-13T17:50:38.901Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "XClarity Administrator",
          "vendor": "Lenovo",
          "versions": [
            {
              "lessThan": "4.1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eA privilege escalation vulnerability was discovered when Single Sign On (SSO) is enabled that could allow an attacker to intercept a valid, authenticated LXCA user\u2019s XCC session if they can convince the user to click on a specially crafted URL.\u003c/span\u003e"
            }
          ],
          "value": "A privilege escalation vulnerability was discovered when Single Sign On (SSO) is enabled that could allow an attacker to intercept a valid, authenticated LXCA user\u2019s XCC session if they can convince the user to click on a specially crafted URL."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-319",
              "description": "CWE-319 Cleartext Transmission of Sensitive Information",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-09-13T17:27:56.092Z",
        "orgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b",
        "shortName": "lenovo"
      },
      "references": [
        {
          "url": "https://support.lenovo.com/us/en/product_security/LEN-154748"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update Lenovo XClarity Administrator to the version (or newer) indicated for your model in the advisory:\u0026nbsp;\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://support.lenovo.com/us/en/product_security/LEN-154748\"\u003ehttps://support.lenovo.com/us/en/product_security/LEN-154748\u003c/a\u003e\u003cbr\u003e"
            }
          ],
          "value": "Update Lenovo XClarity Administrator to the version (or newer) indicated for your model in the advisory:\u00a0 https://support.lenovo.com/us/en/product_security/LEN-154748"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b",
    "assignerShortName": "lenovo",
    "cveId": "CVE-2024-45101",
    "datePublished": "2024-09-13T17:27:56.092Z",
    "dateReserved": "2024-08-21T19:24:36.785Z",
    "dateUpdated": "2024-09-13T17:50:38.901Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"A privilege escalation vulnerability was discovered when Single Sign On (SSO) is enabled that could allow an attacker to intercept a valid, authenticated LXCA user\\u2019s XCC session if they can convince the user to click on a specially crafted URL.\"}, {\"lang\": \"es\", \"value\": \"Se descubri\\u00f3 una vulnerabilidad de escalada de privilegios cuando se habilita Single Sign On (SSO), que podr\\u00eda permitir a un atacante interceptar la sesi\\u00f3n XCC de un usuario LXCA v\\u00e1lido y autenticado si puede convencer al usuario de hacer clic en una URL especialmente manipulada.\"}]",
      "id": "CVE-2024-45101",
      "lastModified": "2024-09-14T11:47:14.677",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"psirt@lenovo.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N\", \"baseScore\": 6.8, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"REQUIRED\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 1.6, \"impactScore\": 5.2}]}",
      "published": "2024-09-13T18:15:04.437",
      "references": "[{\"url\": \"https://support.lenovo.com/us/en/product_security/LEN-154748\", \"source\": \"psirt@lenovo.com\"}]",
      "sourceIdentifier": "psirt@lenovo.com",
      "vulnStatus": "Awaiting Analysis",
      "weaknesses": "[{\"source\": \"psirt@lenovo.com\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-319\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-45101\",\"sourceIdentifier\":\"psirt@lenovo.com\",\"published\":\"2024-09-13T18:15:04.437\",\"lastModified\":\"2024-09-14T11:47:14.677\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A privilege escalation vulnerability was discovered when Single Sign On (SSO) is enabled that could allow an attacker to intercept a valid, authenticated LXCA user\u2019s XCC session if they can convince the user to click on a specially crafted URL.\"},{\"lang\":\"es\",\"value\":\"Se descubri\u00f3 una vulnerabilidad de escalada de privilegios cuando se habilita Single Sign On (SSO), que podr\u00eda permitir a un atacante interceptar la sesi\u00f3n XCC de un usuario LXCA v\u00e1lido y autenticado si puede convencer al usuario de hacer clic en una URL especialmente manipulada.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"psirt@lenovo.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N\",\"baseScore\":6.8,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":1.6,\"impactScore\":5.2}]},\"weaknesses\":[{\"source\":\"psirt@lenovo.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-319\"}]}],\"references\":[{\"url\":\"https://support.lenovo.com/us/en/product_security/LEN-154748\",\"source\":\"psirt@lenovo.com\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-45101\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-13T17:49:37.744521Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:lenovo:xclarity_administrator:*:*:*:*:*:*:*:*\"], \"vendor\": \"lenovo\", \"product\": \"xclarity_administrator\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"4.1\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unaffected\"}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-13T17:50:32.563Z\"}}], \"cna\": {\"source\": {\"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 6.8, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"Lenovo\", \"product\": \"XClarity Administrator\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"4.1\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unaffected\"}], \"solutions\": [{\"lang\": \"en\", \"value\": \"Update Lenovo XClarity Administrator to the version (or newer) indicated for your model in the advisory:\\u00a0 https://support.lenovo.com/us/en/product_security/LEN-154748\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"Update Lenovo XClarity Administrator to the version (or newer) indicated for your model in the advisory:\u0026nbsp;\u003ca target=\\\"_blank\\\" rel=\\\"nofollow\\\" href=\\\"https://support.lenovo.com/us/en/product_security/LEN-154748\\\"\u003ehttps://support.lenovo.com/us/en/product_security/LEN-154748\u003c/a\u003e\u003cbr\u003e\", \"base64\": false}]}], \"references\": [{\"url\": \"https://support.lenovo.com/us/en/product_security/LEN-154748\"}], \"x_generator\": {\"engine\": \"Vulnogram 0.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"A privilege escalation vulnerability was discovered when Single Sign On (SSO) is enabled that could allow an attacker to intercept a valid, authenticated LXCA user\\u2019s XCC session if they can convince the user to click on a specially crafted URL.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003eA privilege escalation vulnerability was discovered when Single Sign On (SSO) is enabled that could allow an attacker to intercept a valid, authenticated LXCA user\\u2019s XCC session if they can convince the user to click on a specially crafted URL.\u003c/span\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-319\", \"description\": \"CWE-319 Cleartext Transmission of Sensitive Information\"}]}], \"providerMetadata\": {\"orgId\": \"da227ddf-6e25-4b41-b023-0f976dcaca4b\", \"shortName\": \"lenovo\", \"dateUpdated\": \"2024-09-13T17:27:56.092Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-45101\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-09-13T17:50:38.901Z\", \"dateReserved\": \"2024-08-21T19:24:36.785Z\", \"assignerOrgId\": \"da227ddf-6e25-4b41-b023-0f976dcaca4b\", \"datePublished\": \"2024-09-13T17:27:56.092Z\", \"assignerShortName\": \"lenovo\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

WID-SEC-W-2024-2110

Vulnerability from csaf_certbund - Published: 2024-09-10 22:00 - Updated: 2024-09-10 22:00

Summary

Lenovo XClarity Administrator (LXCA): Mehrere Schwachstellen ermöglichen Privilegieneskalation

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung

Lenovo XClarity ist ein Verwaltungswerkzeug für Rechenzentren.

Angriff

Ein Angreifer kann mehrere Schwachstellen in Lenovo XClarity ausnutzen, um seine Privilegien zu erhöhen.

Betroffene Betriebssysteme

- Sonstiges - Windows

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "hoch"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Lenovo XClarity ist ein Verwaltungswerkzeug f\u00fcr Rechenzentren.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein Angreifer kann mehrere Schwachstellen in Lenovo XClarity ausnutzen, um seine Privilegien zu erh\u00f6hen.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Sonstiges\n- Windows",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2024-2110 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2024/wid-sec-w-2024-2110.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2024-2110 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2024-2110"
      },
      {
        "category": "external",
        "summary": "Lenovo Security Advisory vom 2024-09-10",
        "url": "https://support.lenovo.com/us/en/product_security/LEN-154748"
      }
    ],
    "source_lang": "en-US",
    "title": "Lenovo XClarity Administrator (LXCA): Mehrere Schwachstellen erm\u00f6glichen Privilegieneskalation",
    "tracking": {
      "current_release_date": "2024-09-10T22:00:00.000+00:00",
      "generator": {
        "date": "2024-09-11T09:38:41.675+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.3.6"
        }
      },
      "id": "WID-SEC-W-2024-2110",
      "initial_release_date": "2024-09-10T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2024-09-10T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "LXCA \u003c4.1",
                "product": {
                  "name": "Lenovo XClarity LXCA \u003c4.1",
                  "product_id": "T037504"
                }
              },
              {
                "category": "product_version",
                "name": "LXCA 4.1",
                "product": {
                  "name": "Lenovo XClarity LXCA 4.1",
                  "product_id": "T037504-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:lenovo:xclarity:lxca__4.1"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "XClarity"
          }
        ],
        "category": "vendor",
        "name": "Lenovo"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-45102",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Lenovo XClarity Administrator (LXCA). Diese Fehler sind auf eine unsachgem\u00e4\u00dfe Handhabung von Berechtigungen in der SSO-Integration, eine unsachgem\u00e4\u00dfe Validierung von Benutzerrechten in der LXCA-Web-API und eine unzureichende Zugriffskontrolle innerhalb der LXCA-Webschnittstelle zur\u00fcckzuf\u00fchren. Ein authentisierter Angreifer kann diese Schwachstellen ausnutzen, um die Zugriffskontrollen zu umgehen und sich erweiterte Rechte zu verschaffen."
        }
      ],
      "product_status": {
        "known_affected": [
          "T037504"
        ]
      },
      "release_date": "2024-09-10T22:00:00.000+00:00",
      "title": "CVE-2024-45102"
    },
    {
      "cve": "CVE-2024-45103",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Lenovo XClarity Administrator (LXCA). Diese Fehler sind auf eine unsachgem\u00e4\u00dfe Handhabung von Berechtigungen in der SSO-Integration, eine unsachgem\u00e4\u00dfe Validierung von Benutzerrechten in der LXCA-Web-API und eine unzureichende Zugriffskontrolle innerhalb der LXCA-Webschnittstelle zur\u00fcckzuf\u00fchren. Ein authentisierter Angreifer kann diese Schwachstellen ausnutzen, um die Zugriffskontrollen zu umgehen und sich erweiterte Rechte zu verschaffen."
        }
      ],
      "product_status": {
        "known_affected": [
          "T037504"
        ]
      },
      "release_date": "2024-09-10T22:00:00.000+00:00",
      "title": "CVE-2024-45103"
    },
    {
      "cve": "CVE-2024-45104",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Lenovo XClarity Administrator (LXCA). Diese Fehler sind auf eine unsachgem\u00e4\u00dfe Handhabung von Berechtigungen in der SSO-Integration, eine unsachgem\u00e4\u00dfe Validierung von Benutzerrechten in der LXCA-Web-API und eine unzureichende Zugriffskontrolle innerhalb der LXCA-Webschnittstelle zur\u00fcckzuf\u00fchren. Ein authentisierter Angreifer kann diese Schwachstellen ausnutzen, um die Zugriffskontrollen zu umgehen und sich erweiterte Rechte zu verschaffen."
        }
      ],
      "product_status": {
        "known_affected": [
          "T037504"
        ]
      },
      "release_date": "2024-09-10T22:00:00.000+00:00",
      "title": "CVE-2024-45104"
    },
    {
      "cve": "CVE-2024-45101",
      "notes": [
        {
          "category": "description",
          "text": "Es besteht eine Schwachstelle in Lenovo XClarity Administrator (LXCA). Dieser Fehler besteht aufgrund der unsachgem\u00e4\u00dfen Behandlung von Sitzungs-Tokens in Single Sign On (SSO), was Session Hijacking erm\u00f6glicht. Ein entfernter, anonymer Angreifer kann diese Schwachstelle ausnutzen, um erweiterte Rechte zu erlangen, indem er einen authentisierten Benutzer dazu verleitet, auf eine speziell gestaltete URL zu klicken und so die XCC-Sitzung des Benutzers abzufangen. F\u00fcr eine erfolgreiche Ausnutzung ist eine Benutzerinteraktion erforderlich."
        }
      ],
      "product_status": {
        "known_affected": [
          "T037504"
        ]
      },
      "release_date": "2024-09-10T22:00:00.000+00:00",
      "title": "CVE-2024-45101"
    }
  ]
}

FKIE_CVE-2024-45101

Vulnerability from fkie_nvd - Published: 2024-09-13 18:15 - Updated: 2024-09-14 11:47

Severity ?

6.8 (Medium) - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

Summary

References

	URL	Tags
	psirt@lenovo.com	https://support.lenovo.com/us/en/product_security/LEN-154748

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A privilege escalation vulnerability was discovered when Single Sign On (SSO) is enabled that could allow an attacker to intercept a valid, authenticated LXCA user\u2019s XCC session if they can convince the user to click on a specially crafted URL."
    },
    {
      "lang": "es",
      "value": "Se descubri\u00f3 una vulnerabilidad de escalada de privilegios cuando se habilita Single Sign On (SSO), que podr\u00eda permitir a un atacante interceptar la sesi\u00f3n XCC de un usuario LXCA v\u00e1lido y autenticado si puede convencer al usuario de hacer clic en una URL especialmente manipulada."
    }
  ],
  "id": "CVE-2024-45101",
  "lastModified": "2024-09-14T11:47:14.677",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.8,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 1.6,
        "impactScore": 5.2,
        "source": "psirt@lenovo.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2024-09-13T18:15:04.437",
  "references": [
    {
      "source": "psirt@lenovo.com",
      "url": "https://support.lenovo.com/us/en/product_security/LEN-154748"
    }
  ],
  "sourceIdentifier": "psirt@lenovo.com",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-319"
        }
      ],
      "source": "psirt@lenovo.com",
      "type": "Secondary"
    }
  ]
}

GHSA-9RRR-65Q4-QRRQ

Vulnerability from github – Published: 2024-09-13 18:31 – Updated: 2024-09-13 18:31

Details

Severity ?

6.8 (Medium)


                  
                    CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2024-45101"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-319"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-09-13T18:15:04Z",
    "severity": "MODERATE"
  },
  "details": "A privilege escalation vulnerability was discovered when Single Sign On (SSO) is enabled that could allow an attacker to intercept a valid, authenticated LXCA user\u2019s XCC session if they can convince the user to click on a specially crafted URL.",
  "id": "GHSA-9rrr-65q4-qrrq",
  "modified": "2024-09-13T18:31:48Z",
  "published": "2024-09-13T18:31:48Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45101"
    },
    {
      "type": "WEB",
      "url": "https://support.lenovo.com/us/en/product_security/LEN-154748"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2024-45101 (GCVE-0-2024-45101)

WID-SEC-W-2024-2110

FKIE_CVE-2024-45101

GHSA-9RRR-65Q4-QRRQ

Tags

Sightings

Nomenclature