Medium severity · published Mar 9, 2021
CVE-2020-8356
An internal product security audit of LXCO, prior to version 1.2.2, discovered that optional passwords, if specified, for the Syslog and SMTP forwarders are written to an internal…
4.9
CVSS
0.6%
EPSS
No
On KEV
Description
An internal product security audit of LXCO, prior to version 1.2.2, discovered that optional passwords, if specified, for the Syslog and SMTP forwarders are written to an internal LXCO log file in clear text. Affected logs are captured in the First Failure Data Capture (FFDC) service log. The FFDC service log is only generated when requested by a privileged LXCO user and it is only accessible to the privileged LXCO user that requested the file.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 47% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
XO
Xclarity Orchestrator · Lenovo
before 1.2.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-8356
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-8356
Vendor Advisory
https://support.lenovo.com/us/en/product_security/LEN-49884
More from Xclarity Orchestrator
8.8
CVE-2026-16793
Remote Command Injection via OS Profile Password in Lenovo XClarity Orchestrator
6.1
CVE-2026-16792
Global TLS Certificate Validation Bypass in Lenovo XClarity Orchestrator
4.9
CVE-2021-3417
An internal product security audit of LXCO, prior to version 1.2.2, discovered that credentials for Lenovo XClarity Administrator (LXCA), if added as a Resource Manager, are…