CVE-2024-8059

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

IPMI credentials may be captured in XCC audit log entries when the account username length is 16 characters.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-319

Affected software

VendorProductVersions
LenovoHX5530 Appliance (ThinkAgile) XCC< 5.10 AFBT50F
LenovoHX7530 Appliance (ThinkAgile) XCC< 5.10 AFBT50F
LenovoST250 V3 (ThinkSystem) XCC< 3.10 CTX318G
LenovoVX3331 Certified Node (ThinkAgile) XCC< 5.10 AFBT50F
LenovoHX Enclosure Certified Node (ThinkAgile) XCC< 6.40 TEI3F3E
LenovoHX1021 Edge Certified Node 3yr (ThinkAgile) XCC< 4.12 TEI3E4D
LenovoHX1320 Appliance (ThinkAgile) XCC< 9.98 CDI3B4E
LenovoHX1321 Certified Node (ThinkAgile) XCC< 9.98 CDI3B4E
LenovoHX1331 Certified Node (ThinkAgile) XCC< 5.10 AFBT50F
LenovoHX1520-R Appliance (ThinkAgile) XCC< 9.98 CDI3B4E
LenovoHX1521-R Certified Node (ThinkAgile) XCC< 9.98 CDI3B4E
LenovoHX2320-E Appliance (ThinkAgile) XCC< 9.98 CDI3B4E
LenovoHX2321 Certified Node (ThinkAgile) XCC< 9.98 CDI3B4E
LenovoHX2330 Appliance (ThinkAgile) XCC< 5.10 AFBT50F
LenovoHX2331 Certified Node (ThinkAgile) XCC< 5.10 AFBT50F
LenovoHX2720-E Appliance (ThinkAgile) XCC< 6.40 TEI3F3E
LenovoHX3320 Appliance (ThinkAgile) XCC< 9.98 CDI3B4E
LenovoHX3321 Certified Node (ThinkAgile) XCC< 9.98 CDI3B4E
LenovoHX3330 Appliance (ThinkAgile) XCC< 5.10 AFBT50F
LenovoHX3331 Certified Node (ThinkAgile) XCC< 5.10 AFBT50F
LenovoHX3331 Node SAP HANA (ThinkAgile) XCC< 5.10 AFBT50F
LenovoHX3375 Appliance (ThinkAgile) XCC< 5.80 D8BT66D
LenovoHX3376 Certified Node (ThinkAgile) XCC< 5.80 D8BT66D
LenovoHX3520-G Appliance (ThinkAgile) XCC< 9.98 CDI3B4E
LenovoHX3521-G Certified Node (ThinkAgile) XCC< 9.98 CDI3B4E
LenovoHX3720 Appliance (ThinkAgile) XCC< 6.40 TEI3F3E
LenovoHX3721 Certified Node (ThinkAgile) XCC< 6.40 TEI3F3E
LenovoHX5520 Appliance (ThinkAgile) XCC< 9.98 CDI3B4E
LenovoHX5520-C Appliance (ThinkAgile) XCC< 9.98 CDI3B4E
LenovoHX5521 Certified Node (ThinkAgile) XCC< 9.98 CDI3B4E
LenovoHX5521-C Certified Node (ThinkAgile) XCC< 9.98 CDI3B4E
LenovoHX5531 Certified Node (ThinkAgile) XCC< 5.10 AFBT50F
LenovoHX7520 Appliance (ThinkAgile) XCC< 9.98 CDI3B4E
LenovoHX7521 Certified Node (ThinkAgile) XCC< 9.98 CDI3B4E
LenovoHX7530 Appl for SAP HANA (ThinkAgile) XCC< 5.10 AFBT50F
LenovoHX7531 Certified Node (ThinkAgile) XCC< 5.10 AFBT50F
LenovoHX7531 Node SAP HANA (ThinkAgile) XCC< 5.10 AFBT50F
LenovoHX7820 Appliance (ThinkAgile) XCC< 3.20 PSI356B
LenovoHX7821 Certified Node (ThinkAgile) XCC< 3.20 PSI356B
LenovoMX Edge Appliance - MX1020 (ThinkAgile) XCC< 4.12 TEI3E4D
LenovoMX3330-F All-flash Appliance (ThinkAgile) XCC< 5.10 AFBT50F
LenovoMX3330-H Hybrid Appliance (ThinkAgile) XCC< 5.10 AFBT50F
LenovoMX3331-F All-flash Certified node (ThinkAgile) XCC< 5.10 AFBT50F
LenovoMX3331-H Hybrid Certified node (ThinkAgile) XCC< 5.10 AFBT50F
LenovoMX3530 F All flash Appliance (ThinkAgile) XCC< 5.10 AFBT50F
LenovoMX3530-H Hybrid Appliance (ThinkAgile) XCC< 5.10 AFBT50F
LenovoMX3531 H Hybrid Certified node (ThinkAgile) XCC< 5.10 AFBT50F
LenovoMX3531-F All-flash Certified node (ThinkAgile) XCC< 5.10 AFBT50F
LenovoP920 Rack Workstation (ThinkStation) XCC< 9.98 CDI3B4E
LenovoSD530 (ThinkSystem) XCC< 6.40 TEI3F3E

References

Timeline

Published
Sep 13, 2024
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2024

CVE-2024-80617.5In version 3.23.0 of aimhubio/aim, certain methods that request data from external servers do not have set timeouts, causing the server to wCVE-2024-80627.5A vulnerability in the typeahead endpoint of h2oai/h2o-3 version 3.46.0 allows for a denial of service. The endpoint performs a `HEAD` requeCVE-2024-80637.5A divide by zero vulnerability exists in ollama/ollama version v0.3.3. The vulnerability occurs when importing GGUF models with a crafted tyCVE-2024-80658.1A Cross-Site Request Forgery (CSRF) vulnerability in version v1.4.1 of danswer-ai/danswer allows attackers to perform unauthorized actions iCVE-2024-80668.8The File Manager Pro – Filester plugin for WordPress is vulnerable to arbitrary file uploads due to missing validation in the 'fsConnector' CVE-2024-80675.8In versions of Helix Core prior to 2024.1 Patch 2 (2024.1/2655224) a Windows ANSI API Unicode "best fit" argument injection was identified.CVE-2024-80688.0Privilege escalation to NetworkService Account access in Citrix Session Recording when an attacker is an authenticated user in the same WindCVE-2024-80698.0Limited remote code execution with privilege of a NetworkService Account access in Citrix Session Recording if the attacker is an authenticaCVE-2024-80708.5CWE-312: Cleartext Storage of Sensitive Information vulnerability exists that exposes test credentials in the firmware binaryCVE-2024-80717.2Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0 and 9.8.x <= 9.8.2 fail to restrict which roles can promote a user as sCVE-2024-80725.3Mage AI allows remote unauthenticated attackers to leak the terminal server command history of arbitrary usersCVE-2024-80739.8Improper Input Validation vulnerability in Hillstone Networks Hillstone Networks Web Application Firewall on 5.5R6 allows Command Injection.
CVE-2024-8059: Medium severity, CVSS 4.3 | Vulnix