Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2019-6195 Details

Description

An authorization bypass exists in Lenovo XClarity Controller (XCC) versions prior to 3.08 CDI340V, 3.01 TEI392O, 1.71 PSI328N where a valid authenticated user with lesser privileges may be granted read-only access to higher-privileged information if 1) “LDAP Authentication Only with Local Authorization” mode is configured and used by XCC, and 2) a lesser privileged user logs into XCC within 1 minute of a higher privileged user logging out. The authorization bypass does not exist when “Local Authentication and Authorization” or “LDAP Authentication and Authorization” modes are configured and used by XCC.

Metrics

CVSS 3.x Severity and Vector Strings:

NIST: [email protected]CVSS-B:4.8 MEDIUMVector:CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N

CNA: [email protected]CVSS-B:4.8 MEDIUMVector:CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://support.lenovo.com/us/en/product_security/LEN-29116	CVE	Vendor Advisory
https://support.lenovo.com/us/en/product_security/LEN-29116	[email protected]	Vendor Advisory

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-269	Improper Privilege Management	[email protected]
CWE-264	Permissions, Privileges, and Access Controls	[email protected]

Affected Products

Product	Versions
lenovo xclarity controller	< 3.01_tei392o < 3.08_cdi340v < 1.71_psi328n
CPE cpe:2.3:a:lenovo:xclarity_controller:::::::: Remediation No remediation found in references.
lenovo thinkagile hx 1000	All versions
CPE cpe:2.3:h:lenovo:thinkagile_hx_1000:-:::::::* Remediation No remediation found in references.
lenovo thinkagile hx 2000	All versions
CPE cpe:2.3:h:lenovo:thinkagile_hx_2000:-:::::::* Remediation No remediation found in references.
lenovo thinkagile hx 3000	All versions
CPE cpe:2.3:h:lenovo:thinkagile_hx_3000:-:::::::* Remediation No remediation found in references.
lenovo thinkagile hx 5000	All versions
CPE cpe:2.3:h:lenovo:thinkagile_hx_5000:-:::::::* Remediation No remediation found in references.
lenovo thinkagile hx 7000	All versions
CPE cpe:2.3:h:lenovo:thinkagile_hx_7000:-:::::::* Remediation No remediation found in references.
lenovo thinkagile vx 1000	All versions
CPE cpe:2.3:h:lenovo:thinkagile_vx_1000:-:::::::* Remediation No remediation found in references.
lenovo thinkagile vx 2000	All versions
CPE cpe:2.3:h:lenovo:thinkagile_vx_2000:-:::::::* Remediation No remediation found in references.
lenovo thinkagile vx 3000	All versions
CPE cpe:2.3:h:lenovo:thinkagile_vx_3000:-:::::::* Remediation No remediation found in references.
lenovo thinkagile vx 5000	All versions
CPE cpe:2.3:h:lenovo:thinkagile_vx_5000:-:::::::* Remediation No remediation found in references.
lenovo thinkagile vx 7000	All versions
CPE cpe:2.3:h:lenovo:thinkagile_vx_7000:-:::::::* Remediation No remediation found in references.
lenovo thinksystem sd530	All versions
CPE cpe:2.3:h:lenovo:thinksystem_sd530:-:::::::* Remediation No remediation found in references.
lenovo thinksystem sd650 dwc	All versions
CPE cpe:2.3:h:lenovo:thinksystem_sd650_dwc:-:::::::* Remediation No remediation found in references.
lenovo thinksystem sn550	All versions
CPE cpe:2.3:h:lenovo:thinksystem_sn550:-:::::::* Remediation No remediation found in references.
lenovo thinksystem sn850	All versions
CPE cpe:2.3:h:lenovo:thinksystem_sn850:-:::::::* Remediation No remediation found in references.
lenovo thinksystem sr150	All versions
CPE cpe:2.3:h:lenovo:thinksystem_sr150:-:::::::* Remediation No remediation found in references.
lenovo thinksystem sr158	All versions
CPE cpe:2.3:h:lenovo:thinksystem_sr158:-:::::::* Remediation No remediation found in references.
lenovo thinksystem sr250	All versions
CPE cpe:2.3:h:lenovo:thinksystem_sr250:-:::::::* Remediation No remediation found in references.
lenovo thinksystem sr258	All versions
CPE cpe:2.3:h:lenovo:thinksystem_sr258:-:::::::* Remediation No remediation found in references.
lenovo thinksystem sr850	All versions
CPE cpe:2.3:h:lenovo:thinksystem_sr850:-:::::::* Remediation No remediation found in references.
lenovo thinksystem sr860	All versions
CPE cpe:2.3:h:lenovo:thinksystem_sr860:-:::::::* Remediation No remediation found in references.
lenovo thinksystem st250	All versions
CPE cpe:2.3:h:lenovo:thinksystem_st250:-:::::::* Remediation No remediation found in references.
lenovo thinksystem st258	All versions
CPE cpe:2.3:h:lenovo:thinksystem_st258:-:::::::* Remediation No remediation found in references.
lenovo thinkagile mx sr650	All versions
CPE cpe:2.3:h:lenovo:thinkagile_mx_sr650:-:::::::* Remediation No remediation found in references.
lenovo thinksystem sr530	All versions
CPE cpe:2.3:h:lenovo:thinksystem_sr530:-:::::::* Remediation No remediation found in references.
lenovo thinksystem sr550	All versions
CPE cpe:2.3:h:lenovo:thinksystem_sr550:-:::::::* Remediation No remediation found in references.
lenovo thinksystem sr570	All versions
CPE cpe:2.3:h:lenovo:thinksystem_sr570:-:::::::* Remediation No remediation found in references.
lenovo thinksystem sr590	All versions
CPE cpe:2.3:h:lenovo:thinksystem_sr590:-:::::::* Remediation No remediation found in references.
lenovo thinksystem sr630	All versions
CPE cpe:2.3:h:lenovo:thinksystem_sr630:-:::::::* Remediation No remediation found in references.
lenovo thinksystem sr650	All versions
CPE cpe:2.3:h:lenovo:thinksystem_sr650:-:::::::* Remediation No remediation found in references.
lenovo thinksystem st550	All versions
CPE cpe:2.3:h:lenovo:thinksystem_st550:-:::::::* Remediation No remediation found in references.
lenovo thinksystem st558	All versions
CPE cpe:2.3:h:lenovo:thinksystem_st558:-:::::::* Remediation No remediation found in references.
lenovo thinksystem sr950 server	All versions
CPE cpe:2.3:h:lenovo:thinksystem_sr950_server:-:::::::* Remediation No remediation found in references.

Change History

5 change records found show changes

Date	Action	Recorded By
Jun 17, 2026	CVE Modified	[email protected]
Nov 21, 2024	CVE Modified	CVE
May 14, 2024	CVE Modified	[email protected]
Mar 4, 2020	Initial Analysis	[email protected]
Feb 14, 2020	CVE Modified	[email protected]

CVE-2019-6195 Details

Description

Metrics

References to Advisories, Solutions, and Tools

Weakness Enumeration

Affected Products

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

Change History

QUICK INFO