Vulnerability CVE-2017-3743
Published: 2017-06-19   Modified: 2017-06-20

Description:
If multiple users are concurrently logged into a single system where one user is sending a command via the Lenovo ToolsCenter Advanced Settings Utility (ASU), UpdateXpress System Pack Installer (UXSPI) or Dynamic System Analysis (DSA) to a second machine, the other users may be able to see the user ID and clear text password that were used to access the second machine during the time the command is processing.

CVSS2 => (AV:N/AC:M/Au:S/C:P/I:N/A:N)

CVSS Base Score
Impact Subscore
Exploitability Subscore
3.5/10
2.9/10
6.8/10
Exploit range
Attack complexity
Authentication
Remote
Medium
Single time
Confidentiality impact
Integrity impact
Availability impact
Partial
None
None
Affected software
Lenovo -> Advanced settings utility 
Lenovo -> Toolscenter dynamic system analysis 
Lenovo -> Updatexpress system pack installer 

 References:
https://support.lenovo.com/us/en/product_security/LEN-10810
Copyright 2024, cxsecurity.com

 

Back to Top