XXE in Lenovo Xclarity Administrator
CVE-2019-6179
An XML External Entity (XXE) processing vulnerability was reported in Lenovo XClarity Administrator (LXCA) prior to version 2.5.0 , Lenovo XClarity Integrator (LXCI) for Microsoft System Center prior to version 7.7.0, and Lenovo XClarity Integrator (LXCI) for VMWare vCenter prior to version 6.1.0 that could allow information disclosure.
Vulnerability class: XXE (XML External Entity)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.
EPSS exploit prediction
EPSS: 0.014 (70.6th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 71st percentile — 70.6% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.014 · newest: 0.014 · change: 0.000
Affected products
- Lenovo Xclarity Administrator
- Lenovo Xclarity Administrator (Lxca) — versions unspecified
- Lenovo Xclarity Integrator
- Lenovo Xclarity Integrator (Lxci) For Microsoft System Center — versions unspecified
- Lenovo Xclarity Integrator (Lxci) For VMware Vcenter — versions unspecified
Weakness classification (CWE)
References
- support.lenovo.com/solutions/LEN-27805 (Vendor Advisory)
Frequently asked questions
- What is CVE-2019-6179?
- CVE-2019-6179 is a high-severity vulnerability in Lenovo Xclarity Administrator, classified under Improper Restriction of XML External Entity Reference (XXE). CVSS score: 7.5/10. Published 2019-09-03.
- How severe is CVE-2019-6179?
- High severity. CVSS v3 base score is 7.5 out of 10.