description: An XML External Entity (XXE) processing vulnerability was reported in Lenovo XClarity Administrator (LXCA) prior to version 2.5.0 , Lenovo XClarity Integrator (LXCI) for Microsoft System Center prior to version 7.7.0, and Lenovo XClarity Integrator (LXCI) for VMWare vCenter prior to version 6.1.0 that could allow information disclosure.
problem types: information disclosure
affected:
{
product: XClarity Administrator (LXCA)
vendor: Lenovo
versions:
lessThan: 2.5.0, status: affected, version: unspecified, versionType: custom
}
{
product: XClarity Integrator (LXCI) for Microsoft System Center
vendor: Lenovo
versions:
lessThan: 7.7.0, status: affected, version: unspecified, versionType: custom
}
{
product: XClarity Integrator (LXCI) for VMware vCenter
vendor: Lenovo
versions:
lessThan: 6.1.0, status: affected, version: unspecified, versionType: custom
}
metrics:
cvssV3_0: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.0
]
solutions: Update your LXCA installation to version 2.5.0 or later.
Update LXCI for Microsoft System Center to version 7.7.0 or later.
Update LXCI for VMware vCenter to version 6.1.0 or later.