Read the docs
TI-2019-14240 Aliases CVE-2019-19757GHSA-gv24-vhxm-xr5j

Cross-site scripting in Lenovo XClarity Administrator

Priority LOW 25CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

An internal product security audit of Lenovo XClarity Administrator (LXCA) discovered a Document Object Model (DOM) based cross-site scripting vulnerability in versions prior to 2.6.6 that could allow JavaScript code to be executed in the user's web browser if a specially crafted link is visited. The JavaScript code is executed on the user's system, not executed on LXCA itself.

Why it matters now

EPSS 0.00521 44th percentileScored 2026-11-07
Fix Fixed XClarity Administrator (LXCA) (Lenovo): 2.6.6

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
LenovoXClarity Administrator (LXCA)before 2.6.62.6.6Patch availableCNA
  • XClarity Administrator (LXCA) VendorLenovo Affected before 2.6.6 Fixed in 2.6.6 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:lenovo:xclarity_administrator:*:*:*:*:*:*:*:*before 2.6.6VulnerableLenovo
  • cpe:2.3:a:lenovo:xclarity_administrator:*:*:*:*:*:*:*:* Versions before 2.6.6 Vulnerable ·Lenovo

Remediation

  • Fix · CNA XClarity Administrator (LXCA) (Lenovo) Fixed in 2.6.6

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Lenovo XClarity Administrator (LXCA) 2.6.6

    3 records Highest priority Priority LOW 3 LOW

    Other records, highest priority first

    • TI-2019-04392 Improper access control in Lenovo XClarity AdministratorPriority LOW 35
    • TI-2019-04393 XML external entity injection in Lenovo XClarity AdministratorPriority LOW 27
    Show all 3 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-19757
  2. 2026-10-03 Alias added: GHSA-gv24-vhxm-xr5j

References

Advisory 1

  • TI-2017-13070 OpenSLP releases in the 1.0.2 and 1.1.0 code streams have a heap-related memory… CVSS 3.0CRITICAL 9.8
  • TI-2016-06786 Sensitive information in log files in Lenovo XClarity Administrator CVSS 3.0CRITICAL 9.8
  • TI-2023-02918 XML external entity injection in Lenovo XClarity Administrator CVSS 3.1HIGH 8.2
  • TI-2018-06582 Improper input validation in Lenovo xClarity Administrator CVSS 3.0HIGH 8.8
  • TI-2019-04361 Sensitive information in log files in Lenovo XClarity Administrator CVSS 3.0HIGH 8.7
  • TI-2018-06580 In Lenovo xClarity Administrator versions earlier than 2.1.0, an authenticated LXCA user… CVSS 3.0HIGH 8.8
See all 26 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences