Non notée
CVE-2019-6187 A stored CSV Injection vulnerability was reported in Lenovo XClarity Controller (XCC) that could allow an administrative…
Description
A stored CSV Injection vulnerability was reported in Lenovo XClarity Controller (XCC) that could allow an administrative or other appropriately permissioned user to store malformed data in certain XCC server informational fields, that could result in crafted formulas being stored in an exported CSV file. The crafted formula is not executed on XCC itself and has no effect on the server.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Lenovo XClarity Controller (XCC) | Versions non publiées |
Autres CVE de Lenovo XClarity Controller (XCC)
Les 4 CVE de Lenovo XClarity Controller (XCC) →
CVE-2023-4608
An authenticated XCC user with elevated privileges can perform blind SQL injection in limited cases through a crafted…
4.1
Moyenne
CVE-2023-4607
An authenticated XCC user can change permissions for any user through a crafted API command
7.5
Élevée
CVE-2023-4606
An authenticated XCC user with Read-Only permission can change a different user’s password through a crafted API…
8.1
Élevée