### [CVE-2019-6195](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-6195)
![](https://img.shields.io/static/v1?label=Product&message=XClarity%20Controller%20(XCC)&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=%3C%203.08%20CDI340V%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-264%20Permissions%2C%20Privileges%2C%20and%20Access%20Controls&color=brighgreen)

### Description

An authorization bypass exists in Lenovo XClarity Controller (XCC) versions prior to 3.08 CDI340V, 3.01 TEI392O, 1.71 PSI328N where a valid authenticated user with lesser privileges may be granted read-only access to higher-privileged information if 1) “LDAP Authentication Only with Local Authorization” mode is configured and used by XCC, and 2) a lesser privileged user logs into XCC within 1 minute of a higher privileged user logging out. The authorization bypass does not exist when “Local Authentication and Authorization” or “LDAP Authentication and Authorization” modes are configured and used by XCC.

### POC

#### Reference
No PoCs from references.

#### Github
- https://github.com/ARPSyndicate/cvemon