CVE-2021-3473 : An internal product security audit of Lenovo XClarity Controller (XCC) discovered that the XCC configuration backup/rest

An internal product security audit of Lenovo XClarity Controller (XCC) discovered that the XCC configuration backup/restore password may be written to an internal XCC log buffer if Lenovo XClarity Administrator (LXCA) is used to perform the backup/restore. The backup/restore password typically exists in this internal log buffer for less than 10 minutes before being overwritten. Generating an FFDC service log will include the log buffer contents, including the backup/restore password if present. The FFDC service log is only generated when requested by a privileged XCC user and it is only accessible to the privileged XCC user that requested the file. The backup/restore password is not captured if the backup/restore is initiated directly from XCC.

Published 2021-04-13 21:15:25

Updated 2021-04-23 19:14:51

Source Lenovo Group Ltd.

View at NVD, CVE.org

Exploit prediction scoring system (EPSS) score for CVE-2021-3473

EPSS FAQ

0.07%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 27 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2021-3473

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
4.0	MEDIUM	AV:N/AC:L/Au:S/C:P/I:N/A:N	8.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: Single Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None
4.9	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N	1.2	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: High User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None
4.5	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N	0.9	3.6	Lenovo Group Ltd.
Attack Vector: Network Attack Complexity: Low Privileges Required: High User Interaction: Required Scope: Unchanged Confidentiality: High Integrity: None Availability: None

CWE ids for CVE-2021-3473

CWE-312 Cleartext Storage of Sensitive Information

The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.

Assigned by: nvd@nist.gov (Primary)

CWE-319 Cleartext Transmission of Sensitive Information

The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.

Assigned by: psirt@lenovo.com (Secondary)

Products affected by CVE-2021-3473

Lenovo » Xclarity Controller » Version: 6.00 Cdi370q
cpe:2.3:a:lenovo:xclarity_controller:6.00_cdi370q:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinkagile Hx1320 » Version: N/A
When used together with: Lenovo » Thinkagile Hx2320 » Version: N/A
When used together with: Lenovo » Thinkagile Hx3320 » Version: N/A
When used together with: Lenovo » Thinkagile Hx3375 » Version: N/A
When used together with: Lenovo » Thinkagile Hx3520-g » Version: N/A
When used together with: Lenovo » Thinkagile Hx3720 » Version: N/A
When used together with: Lenovo » Thinkagile Hx5520 » Version: N/A
When used together with: Lenovo » Thinkagile Hx7520 » Version: N/A
When used together with: Lenovo » Thinkagile Hx7820 » Version: N/A
When used together with: Lenovo » Thinkagile Mx Certified Nodes » Version: N/A
When used together with: Lenovo » Thinkagile Vx 1u » Version: N/A
When used together with: Lenovo » Thinkagile Vx 2u » Version: N/A
When used together with: Lenovo » Thinkagile Vx Dense » Version: N/A
When used together with: Lenovo » Thinksystem Sr530 » Version: N/A
When used together with: Lenovo » Thinksystem Sr570 » Version: N/A
When used together with: Lenovo » Thinksystem Sr590 » Version: N/A
When used together with: Lenovo » Thinksystem Sr630 » Version: N/A
When used together with: Lenovo » Thinksystem Sr650 » Version: N/A
When used together with: Lenovo » Thinksystem St550 » Version: N/A
When used together with: Lenovo » Thinksystem St558 » Version: N/A
Lenovo » Xclarity Controller » Version: 1.10 Tgbt12q
cpe:2.3:a:lenovo:xclarity_controller:1.10_tgbt12q:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinkagile Hx1320 » Version: N/A
When used together with: Lenovo » Thinkagile Hx2320 » Version: N/A
When used together with: Lenovo » Thinkagile Hx3320 » Version: N/A
When used together with: Lenovo » Thinkagile Hx3375 » Version: N/A
When used together with: Lenovo » Thinkagile Hx3520-g » Version: N/A
When used together with: Lenovo » Thinkagile Hx3720 » Version: N/A
When used together with: Lenovo » Thinkagile Hx5520 » Version: N/A
When used together with: Lenovo » Thinkagile Hx7520 » Version: N/A
When used together with: Lenovo » Thinkagile Hx7820 » Version: N/A
When used together with: Lenovo » Thinkagile Mx Certified Nodes » Version: N/A
When used together with: Lenovo » Thinkagile Mx1020 » Version: N/A
When used together with: Lenovo » Thinkagile Vx 1u » Version: N/A
When used together with: Lenovo » Thinkagile Vx 2u » Version: N/A
When used together with: Lenovo » Thinkagile Vx Dense » Version: N/A
When used together with: Lenovo » Thinksystem Se350 » Version: N/A
When used together with: Lenovo » Thinksystem Sr670 » Version: N/A
When used together with: Lenovo » Thinksystem Sr850p » Version: N/A
Lenovo » Xclarity Controller » Version: 2.14 Psi338i
cpe:2.3:a:lenovo:xclarity_controller:2.14_psi338i:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinksystem Sr950 » Version: N/A
Lenovo » Xclarity Controller » Version: 4.40 Tei3b2p
cpe:2.3:a:lenovo:xclarity_controller:4.40_tei3b2p:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinkagile Hx1320 » Version: N/A
When used together with: Lenovo » Thinkagile Hx2320 » Version: N/A
When used together with: Lenovo » Thinkagile Hx3320 » Version: N/A
When used together with: Lenovo » Thinkagile Hx3375 » Version: N/A
When used together with: Lenovo » Thinkagile Hx3520-g » Version: N/A
When used together with: Lenovo » Thinkagile Hx3720 » Version: N/A
When used together with: Lenovo » Thinkagile Hx5520 » Version: N/A
When used together with: Lenovo » Thinkagile Hx7520 » Version: N/A
When used together with: Lenovo » Thinkagile Hx7820 » Version: N/A
When used together with: Lenovo » Thinkagile Vx 1u » Version: N/A
When used together with: Lenovo » Thinkagile Vx 2u » Version: N/A
When used together with: Lenovo » Thinkagile Vx Dense » Version: N/A
When used together with: Lenovo » Thinksystem Sd530 » Version: N/A
When used together with: Lenovo » Thinksystem Sd650 » Version: N/A
When used together with: Lenovo » Thinksystem Sn550 » Version: N/A
When used together with: Lenovo » Thinksystem Sn850 » Version: N/A
When used together with: Lenovo » Thinksystem Sr150 » Version: N/A
When used together with: Lenovo » Thinksystem Sr158 » Version: N/A
When used together with: Lenovo » Thinksystem Sr250 » Version: N/A
When used together with: Lenovo » Thinksystem Sr258 » Version: N/A
When used together with: Lenovo » Thinksystem Sr850 » Version: N/A
When used together with: Lenovo » Thinksystem Sr860 » Version: N/A
When used together with: Lenovo » Thinksystem St250 » Version: N/A
When used together with: Lenovo » Thinksystem St258 » Version: N/A

Vulnerability Details : CVE-2021-3473

Exploit prediction scoring system (EPSS) score for CVE-2021-3473

CVSS scores for CVE-2021-3473

CWE ids for CVE-2021-3473

References for CVE-2021-3473

Products affected by CVE-2021-3473