PT-2019-15259 · Aruba · Cloudvision Portal

Published 2019-12-19 · Updated 2020-08-24 · CVE-2019-18181

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions CloudVision Portal versions 2018.1 through 2018.2

Description The issue allows users with read-only permissions to bypass restrictions for certain functionality through API calls in the Configlet Builder modules. This can enable authenticated users with read-only access to perform actions that are otherwise restricted in the graphical user interface.

Recommendations For CloudVision Portal versions 2018.1 through 2018.2, consider restricting access to the Configlet Builder modules until a fix is available. As a temporary workaround, limit the use of CVP API calls to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2019-18181

Affected Products

Cloudvision Portal

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2019-18181 · Security Note
• https://arista.com/en/support/advisories-notices/security-advisories/9001-security-advisory-44 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-18181 · Vendor Advisory