CVE-2019-6187 : A stored CSV Injection vulnerability was reported in Lenovo XClarity Controller (XCC) that could allow an administrative

A stored CSV Injection vulnerability was reported in Lenovo XClarity Controller (XCC) that could allow an administrative or other appropriately permissioned user to store malformed data in certain XCC server informational fields, that could result in crafted formulas being stored in an exported CSV file. The crafted formula is not executed on XCC itself and has no effect on the server.

Published 2019-11-20 02:15:11

Updated 2020-08-24 17:37:01

Source Lenovo Group Ltd.

View at NVD, CVE.org

Exploit prediction scoring system (EPSS) score for CVE-2019-6187

EPSS FAQ

0.07%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 27 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2019-6187

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
4.0	MEDIUM	AV:N/AC:L/Au:S/C:P/I:N/A:N	8.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: Single Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None
6.5	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N	2.8	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None

CWE ids for CVE-2019-6187

CWE-1236 Improper Neutralization of Formula Elements in a CSV File

The product saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by a spreadsheet product.

Assigned by: nvd@nist.gov (Primary)

Products affected by CVE-2019-6187

Lenovo » Xclarity Controller
Versions before (<) tei392m
cpe:2.3:a:lenovo:xclarity_controller:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinkagile 7x82 » Version: N/A
When used together with: Lenovo » Thinkagile 7y11 » Version: N/A
When used together with: Lenovo » Thinkagile 7y12 » Version: N/A
When used together with: Lenovo » Thinkagile 7y88 » Version: N/A
When used together with: Lenovo » Thinkagile 7y92 » Version: N/A
When used together with: Lenovo » Thinkagile 7z03 » Version: N/A
When used together with: Lenovo » Thinksystem Sd530 » Version: N/A
When used together with: Lenovo » Thinksystem Sd650 » Version: N/A
When used together with: Lenovo » Thinksystem Sn550 » Version: N/A
When used together with: Lenovo » Thinksystem Sn850 » Version: N/A
When used together with: Lenovo » Thinksystem Sr150 » Version: N/A
When used together with: Lenovo » Thinksystem Sr158 » Version: N/A
When used together with: Lenovo » Thinksystem Sr250 » Version: N/A
When used together with: Lenovo » Thinksystem Sr258 » Version: N/A
When used together with: Lenovo » Thinksystem Sr850 » Version: N/A
When used together with: Lenovo » Thinksystem Sr860 » Version: N/A
When used together with: Lenovo » Thinksystem St250 » Version: N/A
When used together with: Lenovo » Thinksystem St258 » Version: N/A
Lenovo » Xclarity Controller
Versions before (<) psi328m
cpe:2.3:a:lenovo:xclarity_controller:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinksystem Sr950 » Version: N/A
Lenovo » Xclarity Controller
Versions before (<) cdi340m
cpe:2.3:a:lenovo:xclarity_controller:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinkagile 7d1h » Version: N/A
When used together with: Lenovo » Thinkagile 7x83 » Version: N/A
When used together with: Lenovo » Thinkagile 7y13 » Version: N/A
When used together with: Lenovo » Thinkagile 7y14 » Version: N/A
When used together with: Lenovo » Thinkagile 7y90 » Version: N/A
When used together with: Lenovo » Thinkagile 7y93 » Version: N/A
When used together with: Lenovo » Thinkagile 7y94 » Version: N/A
When used together with: Lenovo » Thinkagile 7z04 » Version: N/A
When used together with: Lenovo » Thinkagile 7z05 » Version: N/A
When used together with: Lenovo » Thinkagile 7z06 » Version: N/A
When used together with: Lenovo » Thinkagile 7z07 » Version: N/A
When used together with: Lenovo » Thinkagile 7z20 » Version: N/A
When used together with: Lenovo » Thinkagile Yx84 » Version: N/A
When used together with: Lenovo » Thinksystem Sr530 » Version: N/A
When used together with: Lenovo » Thinksystem Sr550 » Version: N/A
When used together with: Lenovo » Thinksystem Sr570 » Version: N/A
When used together with: Lenovo » Thinksystem Sr590 » Version: N/A
When used together with: Lenovo » Thinksystem Sr630 » Version: N/A
When used together with: Lenovo » Thinksystem Sr650 » Version: N/A
When used together with: Lenovo » Thinksystem St550 » Version: N/A
When used together with: Lenovo » Thinksystem St558 » Version: N/A
Lenovo » Xclarity Controller
Versions before (<) g1i312
cpe:2.3:a:lenovo:xclarity_controller:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinksystem Sr670 » Version: N/A

Vulnerability Details : CVE-2019-6187

Exploit prediction scoring system (EPSS) score for CVE-2019-6187

CVSS scores for CVE-2019-6187

CWE ids for CVE-2019-6187

References for CVE-2019-6187

Products affected by CVE-2019-6187