vulnwire
7.5high

CVE-2017-3743

If multiple users are concurrently logged into a single system where one user is sending a command via the Lenovo ToolsCenter Advanced Sett…

Published 9 y ago · modified 4 mo ago · JSON

CVSS
7.5
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
0.7%
percentile 54%
Public exploits
0
none known

If multiple users are concurrently logged into a single system where one user is sending a command via the Lenovo ToolsCenter Advanced Settings Utility (ASU), UpdateXpress System Pack Installer (UXSPI) or Dynamic System Analysis (DSA) to a second machine, the other users may be able to see the user ID and clear text password that were used to access the second machine during the time the command is processing.

Exploit prediction (EPSS)

0.73% probability of exploitation in the next 30 days, higher than 54% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.07.5CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD2.03.5AV:N/AC:M/Au:S/C:P/I:N/A:N

Affected products

  • Lenovo Group Ltd. ToolsCenter

Classification

Weakness
  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

References

  • support.lenovo.com /us/en/product_security/LEN-10810 · x_refsource_CONFIRM, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.