CoreCVE
Back

MEDIUM

An internal product security audit of Lenovo XClarity Administrator (LXCA) prior to version 3.1.0 discovered the Windows OS credentials provided by the LXCA user to perform driver updates of managed systems may be captured in the First Failure Data Capture (FFDC) service log if the service log is generated while managed endpoints are updating

Published Feb 10, 2021

Description

An internal product security audit of Lenovo XClarity Administrator (LXCA) prior to version 3.1.0 discovered the Windows OS credentials provided by the LXCA user to perform driver updates of managed systems may be captured in the First Failure Data Capture (FFDC) service log if the service log is generated while managed endpoints are updating. The service log is only generated when requested by a privileged LXCA user and it is only accessible to the privileged LXCA user that requested the file and is then deleted.

Affected products

Remediation

Vendor solution

Update your LXCA installation to version 3.1.0 or later.

Metrics

Weaknesses (1)

CWE-319

References (1)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner lenovo
Published Feb 10, 2021
Updated Sep 17, 2024
Reserved Jan 28, 2020
Link CVE-2020-8355
CISA Vulnrichment
Updated n/a
NVD
Status Modified
Modified Jun 17, 2026
Link CVE-2020-8355
Red Hat
Severity n/a
Public date n/a
Links CVE-2020-8355