CVE-2019-1667
published 2019-02-21CVE-2019-1667: A vulnerability in the Graphite interface of Cisco HyperFlex software could allow an authenticated, local attacker to write arbitrary data to the Graphite…
PriorityP414low3.3CVSS 3.1
AVLACLPRLUINSUCNILAN
EPSS
0.17%
7.1th percentile
A vulnerability in the Graphite interface of Cisco HyperFlex software could allow an authenticated, local attacker to write arbitrary data to the Graphite interface. The vulnerability is due to insufficient authorization controls. An attacker could exploit this vulnerability by connecting to the Graphite service and sending arbitrary data. A successful exploit could allow the attacker to write arbitrary data to Graphite, which could result in invalid statistics being presented in the interface. Versions prior to 3.5(2a) are affected.
Affected
14 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | cisco_hyperflex_hx-series | >= unspecified < 3.5(2a) | 3.5(2a) |
| cisco | hyperflex | — | — |
| cisco | hyperflex_hx_data_platform | — | — |
| cisco | hyperflex_hx_data_platform | — | — |
| cisco | hyperflex_hx_data_platform | — | — |
| cisco | hyperflex_hx_data_platform | — | — |
| cisco | hyperflex_hx_data_platform | — | — |
| cisco | hyperflex_hx_data_platform | — | — |
| cisco | hyperflex_hx_data_platform | — | — |
| cisco | hyperflex_hx_data_platform | — | — |
| cisco | hyperflex_hx_data_platform | — | — |
| cisco | hyperflex_hx_data_platform | — | — |
| cisco | hyperflex_hx_data_platform | — | — |
| cisco | hyperflex_hx_data_platform | — | — |
CVSS provenance
nvdv3.13.3LOWCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
nvdv3.04.0MEDIUMCVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
nvdv2.02.1LOWAV:L/AC:L/Au:N/C:N/I:P/A:N
vendor_cisco4.0MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-4mrw-m8gp-8hgx: A vulnerability in the Graphite interface of Cisco HyperFlex software could allow an authenticated, local attacker to write arbitrary data to the Grap
ghsa_unreviewed·2022-05-13
CVE-2019-1667 [LOW] CWE-863 GHSA-4mrw-m8gp-8hgx: A vulnerability in the Graphite interface of Cisco HyperFlex software could allow an authenticated, local attacker to write arbitrary data to the Grap
A vulnerability in the Graphite interface of Cisco HyperFlex software could allow an authenticated, local attacker to write arbitrary data to the Graphite interface. The vulnerability is due to insufficient authorization controls. An attacker could exploit this vulnerability by connecting to the Graphite service and sending arbitrary data. A successful exploit could allow the attacker to write arbitrary data to Graphite, which could result in invalid statistics being presented in the interface. Versions prior to 3.5(2a) are affected.
Cisco
Cisco HyperFlex Arbitrary Statistics Write Vulnerability
vendor_cisco·2019-02-20·CVSS 4.0
CVE-2019-1667 [MEDIUM] CWE-345 Cisco HyperFlex Arbitrary Statistics Write Vulnerability
Cisco HyperFlex Arbitrary Statistics Write Vulnerability
A vulnerability in the Graphite interface of Cisco HyperFlex software could allow an authenticated, local attacker to write arbitrary data to the Graphite interface.
The vulnerability is due to insufficient authorization controls. An attacker could exploit this vulnerability by connecting to the Graphite service and sending arbitrary data. A successful exploit could allow the attacker to write arbitrary data to Graphite, which could result in invalid statistics being presented in the interface.
There are no workarounds that address this vulnerability.
This advisory is available at the following link:
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190220-hyper-write
Cisco
Cisco HyperFlex Arbitrary Statistics Write Vulnerability
vendor_cisco·CVSS 3.0
CVE-2019-1667 Cisco HyperFlex Arbitrary Statistics Write Vulnerability
CVE-2019-1667: Cisco HyperFlex Arbitrary Statistics Write Vulnerability
A vulnerability in the Graphite interface of Cisco HyperFlex software could allow an authenticated, local attacker to write arbitrary data to the Graphite interface. The vulnerability is due to insufficient authorization controls. An attacker could exploit this vulnerability by connecting to the Graphite service and sending arbitrary data. A successful exploit could allow the attacker to write arbitrary data to Graphite , which could result in invalid statistics being presented in the interface. There are no
CVSS: 3.0
CWE: CWE-345, CWE-345
Bug IDs: CSCvj95590
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2019-02-21
Published