PT-2018-2134 · Cisco · Cisco Hyperflex

Published 2018-10-03 · Updated 2019-10-09 · CVE-2018-15382

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:C

Name of the Vulnerable Software and Affected Versions Cisco HyperFlex Software (affected versions not specified)

Description The issue is related to insecure external control over critical state data in Cisco HyperFlex. It could allow a remote attacker to create valid signed session tokens and elevate their privileges. The vulnerability is due to a static signing key present in all Cisco HyperFlex systems, which an attacker could exploit to generate valid tokens for unauthorized access to the HyperFlex Web UI.

Recommendations For all affected versions of Cisco HyperFlex Software, consider restricting access to the static signing key to minimize the risk of exploitation. As a temporary workaround, limit access to the HyperFlex Web UI until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-642

Related Identifiers

BDU:2019-00086

CVE-2018-15382

Affected Products

Cisco Hyperflex

References · 6

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181003-hyperflex-secret · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-00086 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2018-15382 · Security Note
• https://osv.dev/vulnerability/CVE-2018-15382 · Vendor Advisory
• http://securityfocus.com/bid/105518 · Note
• https://securityfocus.com/bid/105518/info · Note