In Lenovo xClarity Administrator versions earlier than 2.1.0, an attacker that gains access to the underlying LXCA file system user may be…

Published 8 y ago 2018-07-30 · modified 4 mo ago 2026-06-17 · JSON

CVSS

7.5

v3.0 · NVD

CISA KEV

not known exploited

EPSS

0.5%

percentile 40%

Public exploits

none known

In Lenovo xClarity Administrator versions earlier than 2.1.0, an attacker that gains access to the underlying LXCA file system user may be able to retrieve a credential store containing the service processor user names and passwords for servers previously managed by that LXCA instance, and potentially decrypt those credentials more easily than intended.

Exploit prediction (EPSS)

0.46% probability of exploitation in the next 30 days, higher than 40% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
NVD	3.0	7.5	`CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H`
NVD	2.0	3.5	`AV:N/AC:M/Au:S/C:P/I:N/A:N`

Affected products

Lenovo Group Ltd. Lenovo xClarity Administrator

Classification

Weakness

CWE-312 Cleartext Storage of Sensitive Information

References

support.lenovo.com /us/en/solutions/LEN-22168 · x_refsource_CONFIRM, x_transferred

Sources

CVE List: CVE-2018-9065
NVD: CVE-2018-9065

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.