Lucene search

[email protected]CVE-2019-1666

HistoryFeb 21, 2019 - 7:29 p.m.

CVE-2019-1666

2019-02-2119:29:00

CWE-284

CWE-287

[email protected]

web.nvd.nist.gov

cve-2019-1666

cisco

hyperflex

graphite service

vulnerability

unauthenticated

remote attacker

data retrieval

nvd

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

5.4 Medium

AI Score

Confidence

High

5 Medium

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

0.001 Low

EPSS

Percentile

47.1%

JSON

A vulnerability in the Graphite service of Cisco HyperFlex software could allow an unauthenticated, remote attacker to retrieve data from the Graphite service. The vulnerability is due to insufficient authentication controls. An attacker could exploit this vulnerability by sending crafted requests to the Graphite service. A successful exploit could allow the attacker to retrieve any statistics from the Graphite service. Versions prior to 3.5(2a) are affected.

Affected configurations

NVD

Node

ciscohyperflex_hx_data_platformMatch2.6\(1a\)

ciscohyperflex_hx_data_platformMatch2.6\(1b\)

ciscohyperflex_hx_data_platformMatch2.6\(1d\)

ciscohyperflex_hx_data_platformMatch2.6\(1e\)

ciscohyperflex_hx_data_platformMatch3.0\(1a\)

ciscohyperflex_hx_data_platformMatch3.0\(1b\)

ciscohyperflex_hx_data_platformMatch3.0\(1c\)

ciscohyperflex_hx_data_platformMatch3.0\(1d\)

ciscohyperflex_hx_data_platformMatch3.0\(1e\)

ciscohyperflex_hx_data_platformMatch3.0\(1h\)

ciscohyperflex_hx_data_platformMatch3.0\(1i\)

ciscohyperflex_hx_data_platformMatch3.5\(1a\)

CPENameOperatorVersion
cisco:hyperflex_hx_data_platformcisco hyperflex hx data platformeq2.6\(1a\)
cisco:hyperflex_hx_data_platformcisco hyperflex hx data platformeq2.6\(1b\)
cisco:hyperflex_hx_data_platformcisco hyperflex hx data platformeq2.6\(1d\)
cisco:hyperflex_hx_data_platformcisco hyperflex hx data platformeq2.6\(1e\)
cisco:hyperflex_hx_data_platformcisco hyperflex hx data platformeq3.0\(1a\)
cisco:hyperflex_hx_data_platformcisco hyperflex hx data platformeq3.0\(1b\)
cisco:hyperflex_hx_data_platformcisco hyperflex hx data platformeq3.0\(1c\)
cisco:hyperflex_hx_data_platformcisco hyperflex hx data platformeq3.0\(1d\)
cisco:hyperflex_hx_data_platformcisco hyperflex hx data platformeq3.0\(1e\)
cisco:hyperflex_hx_data_platformcisco hyperflex hx data platformeq3.0\(1h\)

CPE	Name	Operator	Version
cisco:hyperflex_hx_data_platform	cisco hyperflex hx data platform	eq	2.6\(1a\)
cisco:hyperflex_hx_data_platform	cisco hyperflex hx data platform	eq	2.6\(1b\)
cisco:hyperflex_hx_data_platform	cisco hyperflex hx data platform	eq	2.6\(1d\)
cisco:hyperflex_hx_data_platform	cisco hyperflex hx data platform	eq	2.6\(1e\)
cisco:hyperflex_hx_data_platform	cisco hyperflex hx data platform	eq	3.0\(1a\)
cisco:hyperflex_hx_data_platform	cisco hyperflex hx data platform	eq	3.0\(1b\)
cisco:hyperflex_hx_data_platform	cisco hyperflex hx data platform	eq	3.0\(1c\)
cisco:hyperflex_hx_data_platform	cisco hyperflex hx data platform	eq	3.0\(1d\)
cisco:hyperflex_hx_data_platform	cisco hyperflex hx data platform	eq	3.0\(1e\)
cisco:hyperflex_hx_data_platform	cisco hyperflex hx data platform	eq	3.0\(1h\)

Rows per page:

1-10 of 121

CNA Affected

[
  {
    "product": "Cisco HyperFlex HX-Series ",
    "vendor": "Cisco",
    "versions": [
      {
        "lessThan": "3.5(2a)",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

www.securityfocus.com/bid/107108

tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190220-hyper-retrieve

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

5.4 Medium

AI Score

Confidence

High

5 Medium

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

0.001 Low

EPSS

Percentile

47.1%

JSON

Related for CVE-2019-1666

prion1 nvd1 cisco1 cvelist1