Vulnerability Details CVE-2019-19757
An internal product security audit of Lenovo XClarity Administrator (LXCA) discovered a Document Object Model (DOM) based cross-site scripting vulnerability in versions prior to 2.6.6 that could allow JavaScript code to be executed in the user's web browser if a specially crafted link is visited. The JavaScript code is executed on the user's system, not executed on LXCA itself.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.003
EPSS Ranking 53.8%
CVSS Severity
CVSS v3 Score 5.4
CVSS v2 Score 3.5
References
Products affected by CVE-2019-19757
-
cpe:2.3:a:lenovo:xclarity_administrator:1.0.1
-
cpe:2.3:a:lenovo:xclarity_administrator:1.0.3
-
cpe:2.3:a:lenovo:xclarity_administrator:1.1.0
-
cpe:2.3:a:lenovo:xclarity_administrator:1.1.1
-
cpe:2.3:a:lenovo:xclarity_administrator:1.2.1
-
cpe:2.3:a:lenovo:xclarity_administrator:1.2.2
-
cpe:2.3:a:lenovo:xclarity_administrator:1.3.0
-
cpe:2.3:a:lenovo:xclarity_administrator:1.3.1
-
cpe:2.3:a:lenovo:xclarity_administrator:1.3.2
-
cpe:2.3:a:lenovo:xclarity_administrator:1.4.0
-
cpe:2.3:a:lenovo:xclarity_administrator:2.0.0
-
cpe:2.3:a:lenovo:xclarity_administrator:2.1.0
-
cpe:2.3:a:lenovo:xclarity_administrator:2.2.0
-
cpe:2.3:a:lenovo:xclarity_administrator:2.3.0
-
cpe:2.3:a:lenovo:xclarity_administrator:2.4.0
-
cpe:2.3:a:lenovo:xclarity_administrator:2.5.0
-
cpe:2.3:a:lenovo:xclarity_administrator:2.6.0