U.S. flag   An official website of the United States government
Dot gov

Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Https

Secure .gov websites use HTTPS
A lock (Dot gov) or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites.

Vulnerability Change Records for CVE-2019-6195

Change History

Initial Analysis by NIST 3/04/2020 1:26:14 PM

Action Type Old Value New Value
Added CVSS V3.1

								
							
							
						
NIST AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N
Added CVSS V2

								
							
							
						
NIST (AV:N/AC:H/Au:S/C:P/I:N/A:N)
Added CWE

								
							
							
						
NIST CWE-269
Added CPE Configuration

								
							
							
						
AND
     OR
          *cpe:2.3:a:lenovo:xclarity_controller:*:*:*:*:*:*:*:* versions up to (excluding) 1.71_psi328n
     OR
          cpe:2.3:h:lenovo:thinksystem_sr950_server:-:*:*:*:*:*:*:*
Added CPE Configuration

								
							
							
						
AND
     OR
          *cpe:2.3:a:lenovo:xclarity_controller:*:*:*:*:*:*:*:* versions up to (excluding) 3.01_tei392o
     OR
          cpe:2.3:h:lenovo:thinkagile_hx_1000:-:*:*:*:*:*:*:*
          cpe:2.3:h:lenovo:thinkagile_hx_2000:-:*:*:*:*:*:*:*
          cpe:2.3:h:lenovo:thinkagile_hx_3000:-:*:*:*:*:*:*:*
          cpe:2.3:h:lenovo:thinkagile_hx_5000:-:*:*:*:*:*:*:*
          cpe:2.3:h:lenovo:thinkagile_hx_7000:-:*:*:*:*:*:*:*
          cpe:2.3:h:lenovo:thinkagile_vx_1000:-:*:*:*:*:*:*:*
          cpe:2.3:h:lenovo:thinkagile_vx_2000:-:*:*:*:*:*:*:*
          cpe:2.3:h:lenovo:thinkagile_vx_3000:-:*:*:*:*:*:*:*
          cpe:2.3:h:lenovo:thinkagile_vx_5000:-:*:*:*:*:*:*:*
          cpe:2.3:h:lenovo:thinkagile_vx_7000:-:*:*:*:*:*:*:*
          cpe:2.3:h:lenovo:thinksystem_sd530:-:*:*:*:*:*:*:*
          cpe:2.3:h:lenovo:thinksystem_sd650_dwc:-:*:*:*:*:*:*:*
          cpe:2.3:h:lenovo:thinksystem_sn550:-:*:*:*:*:*:*:*
          cpe:2.3:h:lenovo:thinksystem_sn850:-:*:*:*:*:*:*:*
          cpe:2.3:h:lenovo:thinksystem_sr150:-:*:*:*:*:*:*:*
          cpe:2.3:h:lenovo:thinksystem_sr158:-:*:*:*:*:*:*:*
          cpe:2.3:h:lenovo:thinksystem_sr250:-:*:*:*:*:*:*:*
          cpe:2.3:h:lenovo:thinksystem_sr258:-:*:*:*:*:*:*:*
          cpe:2.3:h:lenovo:thinksystem_sr850:-:*:*:*:*:*:*:*
          cpe:2.3:h:lenovo:thinksystem_sr860:-:*:*:*:*:*:*:*
          cpe:2.3:h:lenovo:thinksystem_st250:-:*:*:*:*:*:*:*
          cpe:2.3:h:lenovo:thinksystem_st258:-:*:*:*:*:*:*:*
Added CPE Configuration

								
							
							
						
AND
     OR
          *cpe:2.3:a:lenovo:xclarity_controller:*:*:*:*:*:*:*:* versions up to (excluding) 3.08_cdi340v
     OR
          cpe:2.3:h:lenovo:thinkagile_hx_1000:-:*:*:*:*:*:*:*
          cpe:2.3:h:lenovo:thinkagile_hx_2000:-:*:*:*:*:*:*:*
          cpe:2.3:h:lenovo:thinkagile_hx_3000:-:*:*:*:*:*:*:*
          cpe:2.3:h:lenovo:thinkagile_hx_5000:-:*:*:*:*:*:*:*
          cpe:2.3:h:lenovo:thinkagile_hx_7000:-:*:*:*:*:*:*:*
          cpe:2.3:h:lenovo:thinkagile_mx_sr650:-:*:*:*:*:*:*:*
          cpe:2.3:h:lenovo:thinkagile_vx_1000:-:*:*:*:*:*:*:*
          cpe:2.3:h:lenovo:thinkagile_vx_2000:-:*:*:*:*:*:*:*
          cpe:2.3:h:lenovo:thinkagile_vx_3000:-:*:*:*:*:*:*:*
          cpe:2.3:h:lenovo:thinkagile_vx_5000:-:*:*:*:*:*:*:*
          cpe:2.3:h:lenovo:thinkagile_vx_7000:-:*:*:*:*:*:*:*
          cpe:2.3:h:lenovo:thinksystem_sr530:-:*:*:*:*:*:*:*
          cpe:2.3:h:lenovo:thinksystem_sr550:-:*:*:*:*:*:*:*
          cpe:2.3:h:lenovo:thinksystem_sr570:-:*:*:*:*:*:*:*
          cpe:2.3:h:lenovo:thinksystem_sr590:-:*:*:*:*:*:*:*
          cpe:2.3:h:lenovo:thinksystem_sr630:-:*:*:*:*:*:*:*
          cpe:2.3:h:lenovo:thinksystem_sr650:-:*:*:*:*:*:*:*
          cpe:2.3:h:lenovo:thinksystem_st550:-:*:*:*:*:*:*:*
          cpe:2.3:h:lenovo:thinksystem_st558:-:*:*:*:*:*:*:*
Changed Reference Type
https://support.lenovo.com/us/en/product_security/LEN-29116 No Types Assigned
https://support.lenovo.com/us/en/product_security/LEN-29116 Vendor Advisory
Added CVSS V2 Metadata

								
							
							
						
Victim must voluntarily interact with attack mechanism