Lenovo XClarity Administrator Privilege Escalation Vulnerability via Single Sign-On

A privilege escalation vulnerability exists in Lenovo XClarity Administrator (LXCA) versions prior to 4.1. When LXCA is used as a Single Sign-On (SSO) provider for XCC instances, a valid, authenticated LXCA user could escalate permissions for a connected XCC instance.

Impact

Exploitation of this vulnerability could allow an authenticated LXCA user to gain elevated permissions on a connected XCC instance, potentially leading to unauthorized actions or access.

Remediation

Users are advised to update Lenovo XClarity Administrator to version 4.1 or later. For guidance on updating LXCA, refer to the Lenovo XClarity Update Management documentation.