CiscoCVELIST:CVE-2019-1667CVE-2019-1667 Cisco HyperFlex Arbitrary Statistics Write Vulnerability
4 Medium
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
4.1 Medium
AI Score
Confidence
High
0.0004 Low
EPSS
Percentile
5.1%
A vulnerability in the Graphite interface of Cisco HyperFlex software could allow an authenticated, local attacker to write arbitrary data to the Graphite interface. The vulnerability is due to insufficient authorization controls. An attacker could exploit this vulnerability by connecting to the Graphite service and sending arbitrary data. A successful exploit could allow the attacker to write arbitrary data to Graphite, which could result in invalid statistics being presented in the interface. Versions prior to 3.5(2a) are affected.
CNA Affected
[
{
"product": "Cisco HyperFlex HX-Series ",
"vendor": "Cisco",
"versions": [
{
"lessThan": "3.5(2a)",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
]Related
4 Medium
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
4.1 Medium
AI Score
Confidence
High
0.0004 Low
EPSS
Percentile
5.1%