CVE-2024-38511

CVSS 7.2 HIGHEPSS 1.0%CWE-78

Vexday Risk Score

21Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 7.2EPSS 1.0%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

26 Jul 2024Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

A privilege escalation vulnerability was discovered in an upload processing functionality of XCC that could allow an authenticated XCC user with elevated privileges to perform command injection via specially crafted file uploads.

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected products

Lenovo · XClarity Controller

References

https://support.lenovo.com/us/en/product_security/LEN-156781