An internal product security audit of Lenovo XClarity Controller (XCC) discovered that the XCC configuration backup/restore password may be written to an internal XCC log buffer if Lenovo XClarity Administrator (LXCA) is used to perform the backup/restore. The backup/restore password typically exists in this internal log buffer for less than 10 minutes before being overwritten. Generating an FFDC service log will include the log buffer contents, including the backup/restore password if present. The FFDC service log is only generated when requested by a privileged XCC user and it is only accessible to the privileged XCC user that requested the file. The backup/restore password is not captured if the backup/restore is initiated directly from XCC.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction Required

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

This CVE is not in the KEV list.

The EPSS score is 0.001.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Lenovo XClarity Controller (XCC) affected
Version Status Constraints
unspecified affected < 6.00 CDI370Q
unspecified affected < 1.10 TGBT12Q
unspecified affected < 3.20 TEI378W
unspecified affected < 2.14 PSI338I
unspecified affected < 4.40 TEI3B2P

Configuration 1 [-]

AND
cpe:2.3:a:lenovo:xclarity_controller:6.00_cdi370q:*:*:*:*:*:*:*
OR cpe:2.3:h:lenovo:thinkagile_hx1320:-:*:*:*:*:*:*:*
cpe:2.3:h:lenovo:thinkagile_hx2320:-:*:*:*:*:*:*:*
cpe:2.3:h:lenovo:thinkagile_hx3320:-:*:*:*:*:*:*:*
cpe:2.3:h:lenovo:thinkagile_hx3375:-:*:*:*:*:*:*:*
cpe:2.3:h:lenovo:thinkagile_hx3520-g:-:*:*:*:*:*:*:*
cpe:2.3:h:lenovo:thinkagile_hx3720:-:*:*:*:*:*:*:*
cpe:2.3:h:lenovo:thinkagile_hx5520:-:*:*:*:*:*:*:*
cpe:2.3:h:lenovo:thinkagile_hx7520:-:*:*:*:*:*:*:*
cpe:2.3:h:lenovo:thinkagile_hx7820:-:*:*:*:*:*:*:*
cpe:2.3:h:lenovo:thinkagile_mx_certified_nodes:-:*:*:*:*:*:*:*
cpe:2.3:h:lenovo:thinkagile_vx_1u:-:*:*:*:*:*:*:*
cpe:2.3:h:lenovo:thinkagile_vx_2u:-:*:*:*:*:*:*:*
cpe:2.3:h:lenovo:thinkagile_vx_dense:-:*:*:*:*:*:*:*
cpe:2.3:h:lenovo:thinksystem_sr530:-:*:*:*:*:*:*:*
cpe:2.3:h:lenovo:thinksystem_sr570:-:*:*:*:*:*:*:*
cpe:2.3:h:lenovo:thinksystem_sr590:-:*:*:*:*:*:*:*
cpe:2.3:h:lenovo:thinksystem_sr630:-:*:*:*:*:*:*:*
cpe:2.3:h:lenovo:thinksystem_sr650:-:*:*:*:*:*:*:*
cpe:2.3:h:lenovo:thinksystem_st550:-:*:*:*:*:*:*:*
cpe:2.3:h:lenovo:thinksystem_st558:-:*:*:*:*:*:*:*

Configuration 2 [-]

AND
cpe:2.3:a:lenovo:xclarity_controller:1.10_tgbt12q:*:*:*:*:*:*:*
OR cpe:2.3:h:lenovo:thinkagile_hx1320:-:*:*:*:*:*:*:*
cpe:2.3:h:lenovo:thinkagile_hx2320:-:*:*:*:*:*:*:*
cpe:2.3:h:lenovo:thinkagile_hx3320:-:*:*:*:*:*:*:*
cpe:2.3:h:lenovo:thinkagile_hx3375:-:*:*:*:*:*:*:*
cpe:2.3:h:lenovo:thinkagile_hx3520-g:-:*:*:*:*:*:*:*
cpe:2.3:h:lenovo:thinkagile_hx3720:-:*:*:*:*:*:*:*
cpe:2.3:h:lenovo:thinkagile_hx5520:-:*:*:*:*:*:*:*
cpe:2.3:h:lenovo:thinkagile_hx7520:-:*:*:*:*:*:*:*
cpe:2.3:h:lenovo:thinkagile_hx7820:-:*:*:*:*:*:*:*
cpe:2.3:h:lenovo:thinkagile_mx_certified_nodes:-:*:*:*:*:*:*:*
cpe:2.3:h:lenovo:thinkagile_mx1020:-:*:*:*:*:*:*:*
cpe:2.3:h:lenovo:thinkagile_vx_1u:-:*:*:*:*:*:*:*
cpe:2.3:h:lenovo:thinkagile_vx_2u:-:*:*:*:*:*:*:*
cpe:2.3:h:lenovo:thinkagile_vx_dense:-:*:*:*:*:*:*:*
cpe:2.3:h:lenovo:thinksystem_se350:-:*:*:*:*:*:*:*
cpe:2.3:h:lenovo:thinksystem_sr670:-:*:*:*:*:*:*:*
cpe:2.3:h:lenovo:thinksystem_sr850p:-:*:*:*:*:*:*:*

Configuration 3 [-]

AND
cpe:2.3:a:lenovo:xclarity_controller:2.14_psi338i:*:*:*:*:*:*:*
cpe:2.3:h:lenovo:thinksystem_sr950:-:*:*:*:*:*:*:*

Configuration 4 [-]

AND
cpe:2.3:a:lenovo:xclarity_controller:4.40_tei3b2p:*:*:*:*:*:*:*
OR cpe:2.3:h:lenovo:thinkagile_hx1320:-:*:*:*:*:*:*:*
cpe:2.3:h:lenovo:thinkagile_hx2320:-:*:*:*:*:*:*:*
cpe:2.3:h:lenovo:thinkagile_hx3320:-:*:*:*:*:*:*:*
cpe:2.3:h:lenovo:thinkagile_hx3375:-:*:*:*:*:*:*:*
cpe:2.3:h:lenovo:thinkagile_hx3520-g:-:*:*:*:*:*:*:*
cpe:2.3:h:lenovo:thinkagile_hx3720:-:*:*:*:*:*:*:*
cpe:2.3:h:lenovo:thinkagile_hx5520:-:*:*:*:*:*:*:*
cpe:2.3:h:lenovo:thinkagile_hx7520:-:*:*:*:*:*:*:*
cpe:2.3:h:lenovo:thinkagile_hx7820:-:*:*:*:*:*:*:*
cpe:2.3:h:lenovo:thinkagile_vx_1u:-:*:*:*:*:*:*:*
cpe:2.3:h:lenovo:thinkagile_vx_2u:-:*:*:*:*:*:*:*
cpe:2.3:h:lenovo:thinkagile_vx_dense:-:*:*:*:*:*:*:*
cpe:2.3:h:lenovo:thinksystem_sd530:-:*:*:*:*:*:*:*
cpe:2.3:h:lenovo:thinksystem_sd650:-:*:*:*:*:*:*:*
cpe:2.3:h:lenovo:thinksystem_sn550:-:*:*:*:*:*:*:*
cpe:2.3:h:lenovo:thinksystem_sn850:-:*:*:*:*:*:*:*
cpe:2.3:h:lenovo:thinksystem_sr150:-:*:*:*:*:*:*:*
cpe:2.3:h:lenovo:thinksystem_sr158:-:*:*:*:*:*:*:*
cpe:2.3:h:lenovo:thinksystem_sr250:-:*:*:*:*:*:*:*
cpe:2.3:h:lenovo:thinksystem_sr258:-:*:*:*:*:*:*:*
cpe:2.3:h:lenovo:thinksystem_sr850:-:*:*:*:*:*:*:*
cpe:2.3:h:lenovo:thinksystem_sr860:-:*:*:*:*:*:*:*
cpe:2.3:h:lenovo:thinksystem_st250:-:*:*:*:*:*:*:*
cpe:2.3:h:lenovo:thinksystem_st258:-:*:*:*:*:*:*:*

No data.

No data.

Project Subscriptions

Vendors Products
Lenovo Subscribe
Thinkagile Hx1320 Subscribe
Thinkagile Hx2320 Subscribe
Thinkagile Hx3320 Subscribe
Thinkagile Hx3375 Subscribe
Thinkagile Hx3520-g Subscribe
Thinkagile Hx3720 Subscribe
Thinkagile Hx5520 Subscribe
Thinkagile Hx7520 Subscribe
Thinkagile Hx7820 Subscribe
Thinkagile Mx1020 Subscribe
Thinkagile Mx Certified Nodes Subscribe
Thinkagile Vx 1u Subscribe
Thinkagile Vx 2u Subscribe
Thinkagile Vx Dense Subscribe
Thinksystem Sd530 Subscribe
Thinksystem Sd650 Subscribe
Thinksystem Se350 Subscribe
Thinksystem Sn550 Subscribe
Thinksystem Sn850 Subscribe
Thinksystem Sr150 Subscribe
Thinksystem Sr158 Subscribe
Thinksystem Sr250 Subscribe
Thinksystem Sr258 Subscribe
Thinksystem Sr530 Subscribe
Thinksystem Sr570 Subscribe
Thinksystem Sr590 Subscribe
Thinksystem Sr630 Subscribe
Thinksystem Sr650 Subscribe
Thinksystem Sr670 Subscribe
Thinksystem Sr850 Subscribe
Thinksystem Sr850p Subscribe
Thinksystem Sr860 Subscribe
Thinksystem Sr950 Subscribe
Thinksystem St250 Subscribe
Thinksystem St258 Subscribe
Thinksystem St550 Subscribe
Thinksystem St558 Subscribe
Xclarity Controller Subscribe
Advisories
Source ID Title
EUVD EUVD EUVD-2021-26795 An internal product security audit of Lenovo XClarity Controller (XCC) discovered that the XCC configuration backup/restore password may be written to an internal XCC log buffer if Lenovo XClarity Administrator (LXCA) is used to perform the backup/restore. The backup/restore password typically exists in this internal log buffer for less than 10 minutes before being overwritten. Generating an FFDC service log will include the log buffer contents, including the backup/restore password if present. The FFDC service log is only generated when requested by a privileged XCC user and it is only accessible to the privileged XCC user that requested the file. The backup/restore password is not captured if the backup/restore is initiated directly from XCC.
Fixes

Solution

Update to the Lenovo XClarity Controller (XCC) version (or higher) as recommended in the Product Impact section of LEN-52117.

Workaround

No workaround given by the vendor.

References
Link Providers
https://support.lenovo.com/us/en/product_security/LEN-52117 cve-icon cve-icon
History

No history.

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: lenovo

Published:

Updated: 2024-08-03T16:53:17.827Z

Reserved: 2021-03-29T00:00:00

Link: CVE-2021-3473

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2021-04-13T21:15:25.410

Modified: 2024-11-21T06:21:37.620

Link: CVE-2021-3473

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses