PT-2018-2134 · Cisco · Cisco Hyperflex

Publicado 2018-10-03 · Atualizado 2019-10-09 · CVE-2018-15382

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:C

Name of the Vulnerable Software and Affected Versions Cisco HyperFlex Software (affected versions not specified)

Description The issue is related to insecure external control over critical state data in Cisco HyperFlex. It could allow a remote attacker to create valid signed session tokens and elevate their privileges. The vulnerability is due to a static signing key present in all Cisco HyperFlex systems, which an attacker could exploit to generate valid tokens for unauthorized access to the HyperFlex Web UI.

Recommendations For all affected versions of Cisco HyperFlex Software, consider restricting access to the static signing key to minimize the risk of exploitation. As a temporary workaround, limit access to the HyperFlex Web UI until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Enumeração de Fraquezas

CWE-642

Identificadores relacionados

BDU:2019-00086

CVE-2018-15382

Produtos afetados

Cisco Hyperflex

Referências · 6

• http://securityfocus.com/bid/105518 · Nota
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181003-hyperflex-secret · Aviso do Fabricante
• https://securityfocus.com/bid/105518/info · Nota
• https://bdu.fstec.ru/vul/2019-00086 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2018-15382 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-15382 · Aviso do Fabricante