CVE-2019-6187

6.5 mediumEPSS 0.9%

Medium (6.5) in lenovo xclarity controller. EPSS 0.9% chance of exploitation in the next 30 days.

A stored CSV Injection vulnerability was reported in Lenovo XClarity Controller (XCC) that could allow an administrative or other appropriately permissioned user to store malformed data in certain XCC server informational fields, that could result in crafted formulas being stored in an exported CSV file. The crafted formula is not executed on XCC itself and has no effect on the server.

Severity

CVSS 3.1

6.5 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS: 0.9% chance of exploitation in the next 30 days; higher than 58% of CVEs (scores of 2026-10-31)
CWE: CWE-1236
Published: 2019-11-20
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

lenovo:xclarity_controller

References

https://support.lenovo.com/solutions/LEN-29118
https://support.lenovo.com/solutions/LEN-29118

Check your stack JSON