PT-2019-3738 · Cisco · Cisco Hyperflex

Publicado 2019-09-18 · Atualizado 2019-10-09 · CVE-2019-12620

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Cisco HyperFlex Software (affected versions not specified)

Description The issue is related to insufficient authentication for the statistics collection service, which could allow a remote attacker to inject arbitrary values on an affected device. This could cause the web interface statistics view to present invalid data to users. The attacker could exploit this by sending properly formatted data values to the statistics collection service.

Recommendations For Cisco HyperFlex Software, ensure proper authentication is implemented for the statistics collection service to prevent unauthorized access. As a temporary workaround, consider restricting access to the statistics collection service until a patch is available. Avoid using the statistics collection service until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insufficient Verification of Data Authenticity

Enumeração de Fraquezas

CWE-345

Identificadores relacionados

BDU:2019-03994

CVE-2019-12620

Produtos afetados

Cisco Hyperflex

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2019-12620 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-12620 · Aviso do Fabricante
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190918-hyperflex-valinj · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2019-03994 · Nota de Segurança