CVE-2018-15382

CWE-6424 documents4 sources
Severity
8.6HIGH
EPSS
0.7%
top 28.54%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Cisco Cisco Hyperflex Hx-seriesCisco Hyperflex HX Data Platform
Timeline
PublishedOct 5
Latest updateMay 13

Description

A vulnerability in Cisco HyperFlex Software could allow an unauthenticated, remote attacker to generate valid, signed session tokens. The vulnerability is due to a static signing key that is present in all Cisco HyperFlex systems. An attacker could exploit this vulnerability by accessing the static signing key from one HyperFlex system and using it to generate valid, signed session tokens for another HyperFlex system. A successful exploit could allow the attacker to access the HyperFlex Web UI o…

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:HExploitability: 3.9 | Impact: 4.7

Affected Packages2 packages

🔴Vulnerability Details

2
GHSA
GHSA-w2hw-vrcc-cpx9: A vulnerability in Cisco HyperFlex Software could allow an unauthenticated, remote attacker to generate valid, signed session tokens↗2022-05-13
▶
CVEList
Cisco HyperFlex Software Static Signing Key Vulnerability↗2018-10-05
▶

📋Vendor Advisories

1
Cisco
Cisco HyperFlex Software Static Signing Key Vulnerability↗2018-10-03
▶
CVE-2018-15382 (HIGH CVSS 8.6) | A vulnerability in Cisco HyperFlex | cvebase.io