How severe is CVE-2024-45104?

CVE-2024-45104 has a CVSS 3.x base score of 6.3, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is low, integrity low, and availability low.

Is CVE-2024-45104 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (10th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2024-45104?

CVE-2024-45104 affects Lenovo Xclarity Administrator. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2024-45104?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2024-45104 have an EU (EUVD) identifier?

Yes. CVE-2024-45104 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-41309.

When was CVE-2024-45104 published?

CVE-2024-45104 was published on 2024-09-13 and last updated on 2026-06-17.

CVE-2024-45104

CVE-2024-45104 is a medium-severity vulnerability in Lenovo Xclarity Administrator with a CVSS 3.x base score of 6.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-282.

Key facts

Severity: Medium (CVSS 3.x base score 6.3)
EPSS exploit prediction: 0% (10th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2024-41309
Weakness: CWE-282
Affected product: Lenovo Xclarity Administrator
Published: 2024-09-13
Last modified: 2026-06-17

Description

A valid, authenticated LXCA user without sufficient privileges may be able to use the device identifier to modify an LXCA managed device through a specially crafted web API call.

Frequently asked questions

What is CVE-2024-45104?: A valid, authenticated LXCA user without sufficient privileges may be able to use the device identifier to modify an LXCA managed device through a specially crafted web API call.
How severe is CVE-2024-45104?: CVE-2024-45104 has a CVSS 3.x base score of 6.3, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is low, integrity low, and availability low.
Is CVE-2024-45104 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (10th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2024-45104?: CVE-2024-45104 affects Lenovo Xclarity Administrator. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2024-45104?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2024-45104 have an EU (EUVD) identifier?: Yes. CVE-2024-45104 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-41309.
When was CVE-2024-45104 published?: CVE-2024-45104 was published on 2024-09-13 and last updated on 2026-06-17.

References

https://support.lenovo.com/us/en/product_security/LEN-154748

Affected products (1)

cpe:2.3:a:lenovo:xclarity_administrator:*:*:*:*:*:*:*:*

More vulnerabilities in Lenovo Xclarity Administrator

CVE-2017-17833 — Critical (CVSS 9.8): OpenSLP releases in the 1.0.2 and 1.1.0 code streams have a heap-related memory corruption issue which may manifest…
CVE-2016-8233 — Critical (CVSS 9.8): Log files generated by Lenovo XClarity Administrator (LXCA) versions earlier than 1.2.2 may contain user credentials in…
CVE-2018-9066 — High (CVSS 8.8): In Lenovo xClarity Administrator versions earlier than 2.1.0, an authenticated LXCA user can, under specific…
CVE-2018-9064 — High (CVSS 8.8): In Lenovo xClarity Administrator versions earlier than 2.1.0, an authenticated LXCA user may abuse a web API debug call…
CVE-2017-3770 — High (CVSS 8.8): Privilege escalation vulnerability in LXCA versions earlier than 1.3.2 where an authenticated user may be able to abuse…
CVE-2019-6158 — High (CVSS 8.7): An internal product security audit of Lenovo XClarity Administrator (LXCA) discovered HTTP proxy credentials being…

All CVEs affecting Lenovo Xclarity Administrator →

Other CWE-282 vulnerabilities

CVE-2026-23514 — High (CVSS 8.8): Kiteworks is a private data network (PDN). Versions 9.2.0 and 9.2.1 of Kiteworks Core have an access control…
CVE-2020-10632 — High (CVSS 8.8): Inadequate folder security permissions in Emerson OpenEnterprise versions through 3.3.4 may allow modification of…
CVE-2025-27254 — High (CVSS 8.0): CWE-282 "Improper Ownership Management" in GE Vernova EnerVista UR Setup allows Authentication Bypass. The…
CVE-2024-39755 — High (CVSS 7.8): A privilege escalation vulnerability exists in the node update functionality of Veertu Anka Build 1.42.0. A specially…
CVE-2024-37999 — High (CVSS 7.8): A vulnerability has been identified in Medicalis Workflow Orchestrator (All versions). The affected application…
CVE-2023-0386 — High (CVSS 7.8): A flaw was found in the Linux kernel, where unauthorized access to the execution of the setuid file with capabilities…

Browse all CWE-282 vulnerabilities →