CVE-2024-38511

HIGH

Lenovo XClarity Controller - Authenticated OS Command Injection via File Upload

Title source: llm

Description

A privilege escalation vulnerability was discovered in an upload processing functionality of XCC that could allow an authenticated XCC user with elevated privileges to perform command injection via specially crafted file uploads.

References (1)

Core 1

Core References

Various Sources

https://support.lenovo.com/us/en/product_security/LEN-156781

Scores

CVSS v3 7.2

EPSS 0.0048

EPSS Percentile 65.1%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-78

Status published

Products (1)

Lenovo/XClarity Controller various

Published Jul 26, 2024

Tracked Since Feb 18, 2026