Security readout for executives and security teams
Plain-English summary
Lenovo XClarity Administrator before 1.4.0 could reveal LXCA usernames to unauthenticated people who can reach the web interface. The sources say passwords are not exposed. Business urgency depends mainly on whether the management interface is reachable by untrusted networks.
Executive priority
Treat this as a hygiene and management-plane exposure issue. Prioritize remediation if LXCA is still present, below version 1.4.0, or reachable beyond tightly controlled administrator networks.
Technical view
CVE-2017-3764 affects Lenovo XClarity Administrator versions earlier than 1.4.0. The issue allows unauthenticated exposure of LXCA user account names through the web user interface. The source bundle provides no CVSS score, CWE, proof of exploitation, or detailed attack mechanics.
Likely exposure
Exposure is most likely where Lenovo XClarity Administrator earlier than 1.4.0 remains deployed and its web UI is reachable by unauthenticated or untrusted users.
Exploitation context
The provided sources do not report active exploitation, and the CVE is not listed as KEV. An attacker would need network access to the LXCA web UI. The known impact is username disclosure, which can aid account enumeration but does not disclose passwords.
Researcher notes
The public bundle is sparse: no CVSS vector, CWE, exploit detail, or named vulnerable endpoint is provided. The reliable facts are product, version boundary, unauthenticated username exposure, and no password disclosure.
Mitigation direction
- Upgrade Lenovo XClarity Administrator to 1.4.0 or later if still running an earlier version.
- Restrict LXCA web UI access to trusted administrator networks only.
- Review Lenovo advisory LEN-16335 for current vendor guidance and supported remediation paths.
- Remove internet or broad internal exposure for management interfaces.
Validation and detection
- Inventory Lenovo XClarity Administrator deployments and record installed versions.
- Confirm no LXCA instance earlier than 1.4.0 remains in use.
- Verify web UI access is limited to authorized administrative networks.
- Review access logs for unauthenticated requests to the LXCA web interface.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
Credential and access behavior lookup
The CVE wording references authentication or credential exposure, so valid-account and credential-access review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2017-3764 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://support.lenovo.com/us/en/product_security/LEN-16335CVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.