CVE-2019-1666
published 2019-02-21CVE-2019-1666: A vulnerability in the Graphite service of Cisco HyperFlex software could allow an unauthenticated, remote attacker to retrieve data from the Graphite service…
PriorityP432medium5.3CVSS 3.1
AVNACLPRNUINSUCLINAN
EPSS
2.21%
80.5th percentile
A vulnerability in the Graphite service of Cisco HyperFlex software could allow an unauthenticated, remote attacker to retrieve data from the Graphite service. The vulnerability is due to insufficient authentication controls. An attacker could exploit this vulnerability by sending crafted requests to the Graphite service. A successful exploit could allow the attacker to retrieve any statistics from the Graphite service. Versions prior to 3.5(2a) are affected.
Affected
14 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | cisco_hyperflex_hx-series | >= unspecified < 3.5(2a) | 3.5(2a) |
| cisco | hyperflex_hx_data_platform | — | — |
| cisco | hyperflex_hx_data_platform | — | — |
| cisco | hyperflex_hx_data_platform | — | — |
| cisco | hyperflex_hx_data_platform | — | — |
| cisco | hyperflex_hx_data_platform | — | — |
| cisco | hyperflex_hx_data_platform | — | — |
| cisco | hyperflex_hx_data_platform | — | — |
| cisco | hyperflex_hx_data_platform | — | — |
| cisco | hyperflex_hx_data_platform | — | — |
| cisco | hyperflex_hx_data_platform | — | — |
| cisco | hyperflex_hx_data_platform | — | — |
| cisco | hyperflex_hx_data_platform | — | — |
| cisco | hyperflex_unauthenticated_statistics_retrieval | — | — |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
nvdv3.05.3MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
vendor_cisco5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Cisco
Cisco HyperFlex Unauthenticated Statistics Retrieval Vulnerability
vendor_cisco·2019-02-20·CVSS 5.3
CVE-2019-1666 [MEDIUM] CWE-287 Cisco HyperFlex Unauthenticated Statistics Retrieval Vulnerability
Cisco HyperFlex Unauthenticated Statistics Retrieval Vulnerability
A vulnerability in the Graphite service of Cisco HyperFlex software could allow an unauthenticated, remote attacker to retrieve data from the Graphite service.
The vulnerability is due to insufficient authentication controls. An attacker could exploit this vulnerability by sending crafted requests to the Graphite service. A successful exploit could allow the attacker to retrieve any statistics from the Graphite service.
There are no workarounds that address this vulnerability.
This advisory is available at the following link:
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190220-hyper-retrieve
Cisco
Cisco HyperFlex Unauthenticated Statistics Retrieval Vulnerability
vendor_cisco·CVSS 3.0
CVE-2019-1666 Cisco HyperFlex Unauthenticated Statistics Retrieval Vulnerability
CVE-2019-1666: Cisco HyperFlex Unauthenticated Statistics Retrieval Vulnerability
A vulnerability in the Graphite service of Cisco HyperFlex software could allow an unauthenticated, remote attacker to retrieve data from the Graphite service. The vulnerability is due to insufficient authentication controls. An attacker could exploit this vulnerability by sending crafted requests to the Graphite service. A successful exploit could allow the attacker to retrieve any statistics from the Graphite service. There are no
CVSS: 3.0
CWE: CWE-287, CWE-287
Bug IDs: CSCvj95580
GHSA
GHSA-268p-g9gf-2gh5: A vulnerability in the Graphite service of Cisco HyperFlex software could allow an unauthenticated, remote attacker to retrieve data from the Graphite
ghsa_unreviewed·2022-05-13
CVE-2019-1666 [MEDIUM] CWE-287 GHSA-268p-g9gf-2gh5: A vulnerability in the Graphite service of Cisco HyperFlex software could allow an unauthenticated, remote attacker to retrieve data from the Graphite
A vulnerability in the Graphite service of Cisco HyperFlex software could allow an unauthenticated, remote attacker to retrieve data from the Graphite service. The vulnerability is due to insufficient authentication controls. An attacker could exploit this vulnerability by sending crafted requests to the Graphite service. A successful exploit could allow the attacker to retrieve any statistics from the Graphite service. Versions prior to 3.5(2a) are affected.
No detection rules found.
No public exploits indexed.
2019-02-21
Published