CVE-2019-6158

MediumCVSS 5.9/10Last modified Jun 17, 2026

Description

An internal product security audit of Lenovo XClarity Administrator (LXCA) discovered HTTP proxy credentials being written to a log file in clear text. This only affects LXCA when HTTP proxy credentials have been configured. This affects LXCA versions 2.0.0 to 2.3.x.

Metrics

CVSS 3.0 5.9/10CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-532

Affected software

VendorProductVersions
LenovoLenovo XClarity Administrator>= unspecified, < 2.3.x

References

Timeline

Published
May 3, 2019
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-61596.1A stored cross-site scripting (XSS) vulnerability exists in various firmware versions of the legacy IBM System x IMM (IMM v1) embedded BasebCVE-2019-61607.5A vulnerability in various versions of Iomega and LenovoEMC NAS products could allow an unauthenticated user to access files on NAS shares vCVE-2019-61617.5An internal product security audit discovered a session handling vulnerability in the web interface of ThinkAgile CP-SB (Storage Block) BMC CVE-2019-61637.5A denial of service vulnerability was reported in Lenovo System Update before version 5.07.0084 that could allow service log files to be wriCVE-2019-61657.8A DLL search path vulnerability was reported in PaperDisplay Hotkey Service version 1.2.0.8 that could allow privilege escalation. Lenovo haCVE-2019-61668.8A vulnerability reported in Lenovo Service Bridge before version 4.1.0.1 could allow cross-site request forgery.CVE-2019-61679.8A vulnerability reported in Lenovo Service Bridge before version 4.1.0.1 could allow remote code execution.CVE-2019-61689.8A vulnerability reported in Lenovo Service Bridge before version 4.1.0.1 could allow remote code execution.CVE-2019-61697.5A vulnerability reported in Lenovo Service Bridge before version 4.1.0.1 could allow unencrypted downloads over FTP.CVE-2019-61706.4A potential vulnerability in the SMI callback function used in the Legacy USB driver using boot services structure in runtime phase in some CVE-2019-61716.8A vulnerability was reported in various BIOS versions of older ThinkPad systems that could allow a user with administrative privileges or phCVE-2019-61726.4A potential vulnerability in the SMI callback function used in Legacy USB driver using passed parameter without sufficient checking in some
CVE-2019-6158: Medium severity, CVSS 5.9 | Vulnix