Not rated
CVE-2019-6187 A stored CSV Injection vulnerability was reported in Lenovo XClarity Controller (XCC) that could allow an administrative…
Description
A stored CSV Injection vulnerability was reported in Lenovo XClarity Controller (XCC) that could allow an administrative or other appropriately permissioned user to store malformed data in certain XCC server informational fields, that could result in crafted formulas being stored in an exported CSV file. The crafted formula is not executed on XCC itself and has no effect on the server.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Lenovo XClarity Controller (XCC) | Versions not published |
Other CVEs of Lenovo XClarity Controller (XCC)
The 4 CVEs of Lenovo XClarity Controller (XCC) →
CVE-2023-4608
An authenticated XCC user with elevated privileges can perform blind SQL injection in limited cases through a crafted…
4.1
Medium
CVE-2023-4607
An authenticated XCC user can change permissions for any user through a crafted API command
7.5
High
CVE-2023-4606
An authenticated XCC user with Read-Only permission can change a different user’s password through a crafted API…
8.1
High