CVE-2019-6195 | Date: (C)2020-02-17 (M)2023-12-22 |
An authorization bypass exists in Lenovo XClarity Controller (XCC) versions prior to 3.08 CDI340V, 3.01 TEI392O, 1.71 PSI328N where a valid authenticated user with lesser privileges may be granted read-only access to higher-privileged information if 1) ���LDAP Authentication Only with Local Authorization��� mode is configured and used by XCC, and 2) a lesser privileged user logs into XCC within 1 minute of a higher privileged user logging out. The authorization bypass does not exist when ���Local Authentication and Authorization��� or ���LDAP Authentication and Authorization��� modes are configured and used by XCC.
CVSS Score and Metrics +CVSS Score and Metrics -CVSS V3 Severity: | CVSS V2 Severity: |
CVSS Score : 4.8 | CVSS Score : 2.1 |
Exploit Score: 1.2 | Exploit Score: 3.9 |
Impact Score: 3.6 | Impact Score: 2.9 |
|
CVSS V3 Metrics: | CVSS V2 Metrics: |
Attack Vector: NETWORK | Access Vector: NETWORK |
Attack Complexity: HIGH | Access Complexity: HIGH |
Privileges Required: LOW | Authentication: SINGLE |
User Interaction: REQUIRED | Confidentiality: PARTIAL |
Scope: UNCHANGED | Integrity: NONE |
Confidentiality: HIGH | Availability: NONE |
Integrity: NONE | |
Availability: NONE | |
| |