Lucene search

LenovoCVE-2019-6154

HistoryApr 10, 2019 - 5:29 p.m.

CVE-2019-6154

2019-04-1017:29:00

CWE-426

lenovo

web.nvd.nist.gov

cve-2019-6154

dll search path vulnerability

lenovo bootable generator

local access

code execution

nvd

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

30.3%

JSON

A DLL search path vulnerability was reported in Lenovo Bootable Generator, prior to version Mar-2019, that could allow a malicious user with local access to execute code on the system.

Affected configurations

Nvd

Node

lenovobootable_usbRange<mar-2019windows

AND

lenovoideacentreMatch-

lenovothinkcentreMatch-

lenovothinkpadMatch-

lenovothinkstationMatch-

VendorProductVersionCPE
lenovobootable_usb*cpe:2.3:a:lenovo:bootable_usb:*:*:*:*:*:windows:*:*
lenovoideacentre-cpe:2.3:h:lenovo:ideacentre:-:*:*:*:*:*:*:*
lenovothinkcentre-cpe:2.3:h:lenovo:thinkcentre:-:*:*:*:*:*:*:*
lenovothinkpad-cpe:2.3:h:lenovo:thinkpad:-:*:*:*:*:*:*:*
lenovothinkstation-cpe:2.3:h:lenovo:thinkstation:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
lenovo	bootable_usb	*	cpe:2.3:a:lenovo:bootable_usb::::::windows::*
lenovo	ideacentre	-	cpe:2.3:h:lenovo:ideacentre:-:::::::*
lenovo	thinkcentre	-	cpe:2.3:h:lenovo:thinkcentre:-:::::::*
lenovo	thinkpad	-	cpe:2.3:h:lenovo:thinkpad:-:::::::*
lenovo	thinkstation	-	cpe:2.3:h:lenovo:thinkstation:-:::::::*

CNA Affected

[
  {
    "product": "Lenovo Bootable Generator",
    "vendor": "Lenovo",
    "versions": [
      {
        "lessThan": "Mar-2019",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

support.lenovo.com/solutions/LEN-25401

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

30.3%

JSON

Related for CVE-2019-6154