CoreCVE
Back

HIGH

In Lenovo XClarity Administrator (LXCA) before 1.3.0, if service data is downloaded from LXCA, a non-administrative user may have access to password information for users that have previously authenticated to the LXCA's internal LDAP server, including administrative accounts and service accounts with administrative privileges

Published Jun 20, 2017

Description

In Lenovo XClarity Administrator (LXCA) before 1.3.0, if service data is downloaded from LXCA, a non-administrative user may have access to password information for users that have previously authenticated to the LXCA's internal LDAP server, including administrative accounts and service accounts with administrative privileges. This is an issue only for users who have used local authentication with LXCA and not remote authentication against external LDAP or ADFS servers.

Affected products

Remediation

No remediation recorded yet.

Metrics

Weaknesses (1)

CWE-287

Improper Authentication

References (1)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner lenovo
Published Jun 20, 2017
Updated Aug 5, 2024
Reserved Dec 16, 2016
Link CVE-2017-3745
CISA Vulnrichment
Updated n/a
NVD
Status Modified
Modified Jun 17, 2026
Link CVE-2017-3745
Red Hat
Severity n/a
Public date n/a
Links CVE-2017-3745