CVE-2020-8355
Last modified
CVE-2020-8355 is a medium-severity vulnerability rated 4.9/10 on the CVSS scale. An internal product security audit of Lenovo XClarity Administrator (LXCA) prior to version 3.1.0 discovered the Windows OS credentials provided by the LXCA user to perform driver updates of managed systems may be captured in the First Failure Data Capture (FFDC) service log if the service log is generated while managed endpoints are updating. The service log is only generated when requested by a privileged LXCA user and it is only accessible to the privileged LXCA user that requested the file and is then deleted.. EPSS estimates a 0.51% chance of exploitation in the next 30 days.
Description
An internal product security audit of Lenovo XClarity Administrator (LXCA) prior to version 3.1.0 discovered the Windows OS credentials provided by the LXCA user to perform driver updates of managed systems may be captured in the First Failure Data Capture (FFDC) service log if the service log is generated while managed endpoints are updating. The service log is only generated when requested by a privileged LXCA user and it is only accessible to the privileged LXCA user that requested the file and is then deleted.
Metrics
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Lenovo | Xclarity Administrator | < 3.1.0 |
References
- https://support.lenovo.com/us/en/product_security/LEN-50446Vendor Advisory
- https://support.lenovo.com/us/en/product_security/LEN-50446Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2020-8355?
How severe is CVE-2020-8355?
How do I fix CVE-2020-8355?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2020
- CVE-2020-8349An internal security review has identified an unauthenticate…9.8
- CVE-2020-8350An authentication bypass vulnerability was reported in Lenov…8.8
- CVE-2020-8351A privilege escalation vulnerability was reported in Lenovo …7.8
- CVE-2020-8352In some Lenovo Desktop models, the Configuration Change Dete…2.4
- CVE-2020-8353Prior to August 10, 2020, some Lenovo Desktop and Workstatio…6.7
- CVE-2020-8354A potential vulnerability in the SMI callback function used …6.7
- CVE-2020-8356An internal product security audit of LXCO, prior to version…4.9
- CVE-2020-8357A denial of service vulnerability was reported in Lenovo PCM…5.5
- CVE-2020-8358Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
- CVE-2020-8359Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
- CVE-2020-8360Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
- CVE-2020-8361Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
Are you affected by CVE-2020-8355?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST