CVE-2017-3764

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

A vulnerability was identified in Lenovo XClarity Administrator (LXCA) before 1.4.0 where LXCA user account names may be exposed to unauthenticated users with access to the LXCA web user interface. No password information of the user accounts is exposed.

Metrics

CVSS 3.0 5.3/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
Lenovo Group Ltd.	xClarity Administrator	Earlier than 1.4.0

References

https://support.lenovo.com/us/en/product_security/LEN-16335Patch, Vendor Advisory
https://support.lenovo.com/us/en/product_security/LEN-16335Patch, Vendor Advisory

Timeline

Published: Nov 30, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-37657.0In Enterprise Networking Operating System (ENOS) in Lenovo and IBM RackSwitch and BladeCenter products, an authentication bypass known as "H CVE-2017-37677.8A local privilege escalation vulnerability was identified in the Realtek audio driver versions prior to 6.0.1.8224 in some Lenovo ThinkPad p CVE-2017-37687.5An unprivileged attacker with connectivity to the IMM2 could cause a denial of service attack on the IMM2 (Versions earlier than 4.4 for Len CVE-2017-37708.8Privilege escalation vulnerability in LXCA versions earlier than 1.3.2 where an authenticated user may be able to abuse certain web interfac CVE-2017-37717.5System boot process is not adequately secured In Lenovo E95 and ThinkCentre M710s/M710t because systems were shipped from factory without co CVE-2017-37725.5A vulnerability was reported in Lenovo PC Manager versions prior to 2.6.40.3154 that could allow an attacker to cause a system reboot.CVE-2017-37749.8A stack overflow vulnerability was discovered within the web administration service in Integrated Management Module 2 (IMM2) earlier than ve CVE-2017-37756.4Some Lenovo System x server BIOS/UEFI versions, when Secure Boot mode is enabled by a system administrator, do not properly authenticate sig CVE-2017-37767.5Lenovo Help Android mobile app versions earlier than 6.1.2.0327 allowed information to be transmitted over an HTTP channel, permitting other CVE-2017-37908.6A vulnerability in the received packet parser of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) software co CVE-2017-379110.0A vulnerability in the web-based GUI of Cisco Prime Home could allow an unauthenticated, remote attacker to bypass authentication and execut CVE-2017-37929.8A vulnerability in a proprietary device driver in the kernel of Cisco TelePresence Multipoint Control Unit (MCU) Software could allow an una