FKIE_CVE-2019-6187

Vulnerability from fkie_nvd - Published: 2019-11-20 02:15 - Updated: 2024-11-21 04:46
Severity ?
6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Summary
A stored CSV Injection vulnerability was reported in Lenovo XClarity Controller (XCC) that could allow an administrative or other appropriately permissioned user to store malformed data in certain XCC server informational fields, that could result in crafted formulas being stored in an exported CSV file. The crafted formula is not executed on XCC itself and has no effect on the server.
References
psirt@lenovo.comhttps://support.lenovo.com/solutions/LEN-29118Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://support.lenovo.com/solutions/LEN-29118Patch, Vendor Advisory
Impacted products
Vendor Product Version
lenovo xclarity_controller *
lenovo thinkagile_7x82 -
lenovo thinkagile_7y11 -
lenovo thinkagile_7y12 -
lenovo thinkagile_7y88 -
lenovo thinkagile_7y92 -
lenovo thinkagile_7z03 -
lenovo thinksystem_sd530 -
lenovo thinksystem_sd650 -
lenovo thinksystem_sn550 -
lenovo thinksystem_sn850 -
lenovo thinksystem_sr150 -
lenovo thinksystem_sr158 -
lenovo thinksystem_sr250 -
lenovo thinksystem_sr258 -
lenovo thinksystem_sr850 -
lenovo thinksystem_sr860 -
lenovo thinksystem_st250 -
lenovo thinksystem_st258 -
lenovo xclarity_controller *
lenovo thinkagile_7d1h -
lenovo thinkagile_7x83 -
lenovo thinkagile_7y13 -
lenovo thinkagile_7y14 -
lenovo thinkagile_7y90 -
lenovo thinkagile_7y93 -
lenovo thinkagile_7y94 -
lenovo thinkagile_7z04 -
lenovo thinkagile_7z05 -
lenovo thinkagile_7z06 -
lenovo thinkagile_7z07 -
lenovo thinkagile_7z20 -
lenovo thinkagile_yx84 -
lenovo thinksystem_sr530 -
lenovo thinksystem_sr550 -
lenovo thinksystem_sr570 -
lenovo thinksystem_sr590 -
lenovo thinksystem_sr630 -
lenovo thinksystem_sr650 -
lenovo thinksystem_st550 -
lenovo thinksystem_st558 -
lenovo xclarity_controller *
lenovo _thinksystem_sr670 -
lenovo xclarity_controller *
lenovo thinksystem_sr950 -
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:lenovo:xclarity_controller:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "2DEA7654-0593-4CEA-9040-078D4801C871",
              "versionEndExcluding": "tei392m",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:lenovo:thinkagile_7x82:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "6C022FCB-ECB4-4E33-84E9-28E97AF1C21F",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:lenovo:thinkagile_7y11:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "3A1B8C35-DF16-4D29-AF9E-01339AC9BED4",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:lenovo:thinkagile_7y12:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "99BA98D3-E3A9-49A0-9B0E-967B9126675B",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:lenovo:thinkagile_7y88:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "D51EBEBE-ADB7-48C3-9848-E3203333F2FE",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:lenovo:thinkagile_7y92:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "E914E260-382D-4CD0-BCE1-D960DAA30E05",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:lenovo:thinkagile_7z03:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "B8279AC5-03B1-44D6-8C9B-989F2C281641",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:lenovo:thinksystem_sd530:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "2588DA2E-6E58-4FA2-9AA6-FC669C042197",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:lenovo:thinksystem_sd650:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "7A1FF5D0-CC08-42B0-9798-55ED911B3EF6",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:lenovo:thinksystem_sn550:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "5DB64709-93BA-43D8-A1DB-4CE405291430",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:lenovo:thinksystem_sn850:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "1DB0C393-2CB4-485F-93E2-2F28B19F9325",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:lenovo:thinksystem_sr150:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "C6334030-07E4-45F4-A233-4A37F77FC573",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:lenovo:thinksystem_sr158:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "D94182EE-10FE-4506-BDE0-06F4140923FC",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:lenovo:thinksystem_sr250:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "C5B52AC1-714E-4217-8599-80D99E0D33B3",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:lenovo:thinksystem_sr258:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "DB19D273-4975-4957-AE94-117B607CD746",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:lenovo:thinksystem_sr850:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "19771143-D5F1-4F2F-AB83-09913894681E",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:lenovo:thinksystem_sr860:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "EAF08144-ECCB-477B-A934-E4578522BFEE",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:lenovo:thinksystem_st250:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "DBF2350D-34B1-44DB-8E4A-6F29B37D96CF",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:lenovo:thinksystem_st258:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "089F97B1-FEDE-4A5D-91D3-0517E8D39174",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:lenovo:xclarity_controller:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "C03E8D97-6337-4E22-8125-8CED65281D5C",
              "versionEndExcluding": "cdi340m",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:lenovo:thinkagile_7d1h:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "0BCA03A8-09C3-47A3-9715-D869B848771B",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:lenovo:thinkagile_7x83:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "D84E8645-BDEA-4DBD-972B-FFEEBD6EEA85",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:lenovo:thinkagile_7y13:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "B39D9ADA-4F3C-43A6-902F-E6626BC692F9",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:lenovo:thinkagile_7y14:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "7FB46A9B-16D9-4D4C-9BE1-813452C51C11",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:lenovo:thinkagile_7y90:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "31DAB6CE-B360-489B-93DF-F98C4DE85DFE",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:lenovo:thinkagile_7y93:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "634E0104-AD3D-48A3-B0E0-A74C15FAACC7",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:lenovo:thinkagile_7y94:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "B0B0F1CD-A017-4C20-AEB9-F80BA7FF304B",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:lenovo:thinkagile_7z04:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "871F4EE6-3E47-499E-9650-47AB35EBBD9E",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:lenovo:thinkagile_7z05:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "29D7C95C-F43D-4A1A-BD8B-5F40D8003477",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:lenovo:thinkagile_7z06:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "792A1744-DFC1-420D-BFD5-60AE54DA54CC",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:lenovo:thinkagile_7z07:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "6F814B1C-E4E4-48BA-92C4-39B7997B51F4",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:lenovo:thinkagile_7z20:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "40516AAC-4F19-4AE8-9C0B-0697D36FB0F9",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:lenovo:thinkagile_yx84:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "6876F1AA-3196-4576-B8F4-202266DA64EF",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:lenovo:thinksystem_sr530:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "F4C6628A-8A99-4841-A7C5-0445A03C638D",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:lenovo:thinksystem_sr550:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "D10850BF-A7EA-4B84-B2EF-66DCCC301514",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:lenovo:thinksystem_sr570:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "8A7C5BE3-5429-46B0-B0B5-C86A9B6376A7",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:lenovo:thinksystem_sr590:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "A3DC615C-A88A-4C45-892F-77C5E84104E8",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:lenovo:thinksystem_sr630:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "D7F10C8D-C9C7-4FAD-980D-7A602C8BE81D",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:lenovo:thinksystem_sr650:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "C6C2B5BB-6E1F-4E01-AAE8-A8239AB8945E",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:lenovo:thinksystem_st550:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "A5B19107-5B45-4E45-8B34-90B5A1FF3962",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:lenovo:thinksystem_st558:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "30CFA6D5-7D07-4BFF-8AD2-DE591EDE0186",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:lenovo:xclarity_controller:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "D93ED5C3-F8AF-4793-8CD5-2795EDE1CC04",
              "versionEndExcluding": "g1i312",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:lenovo:_thinksystem_sr670:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "158A1ED4-96CD-4F8B-B607-6AC5AF12E057",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:lenovo:xclarity_controller:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "AB970505-71D1-4802-8D9F-6D81A4024470",
              "versionEndExcluding": "psi328m",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:lenovo:thinksystem_sr950:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "B6B0407D-D603-48AE-9A42-F4C68056E19D",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A stored CSV Injection vulnerability was reported in Lenovo XClarity Controller (XCC) that could allow an administrative or other appropriately permissioned user to store malformed data in certain XCC server informational fields, that could result in crafted formulas being stored in an exported CSV file. The crafted formula is not executed on XCC itself and has no effect on the server."
    },
    {
      "lang": "es",
      "value": "Se report\u00f3 una vulnerabilidad de inyecci\u00f3n CSV almacenada en Lenovo XClarity Controller (XCC) lo que podr\u00eda permitir a un usuario administrativo u otro usuario con permiso apropiado almacenar datos malformados en determinados campos informativos del servidor de XCC, que podr\u00eda resultar en que las f\u00f3rmulas especialmente dise\u00f1adas sean almacenadas en un archivo CSV exportado. La f\u00f3rmula especialmente dise\u00f1ada no es ejecutada en XCC y no tiene ning\u00fan efecto en el servidor."
    }
  ],
  "id": "CVE-2019-6187",
  "lastModified": "2024-11-21T04:46:07.577",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "SINGLE",
          "availabilityImpact": "NONE",
          "baseScore": 4.0,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "NONE",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 8.0,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2019-11-20T02:15:10.787",
  "references": [
    {
      "source": "psirt@lenovo.com",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://support.lenovo.com/solutions/LEN-29118"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://support.lenovo.com/solutions/LEN-29118"
    }
  ],
  "sourceIdentifier": "psirt@lenovo.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-1236"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.