PT-2019-3738 · Cisco · Cisco Hyperflex

Published 2019-09-18 · Updated 2019-10-09 · CVE-2019-12620

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Cisco HyperFlex Software (affected versions not specified)

Description The issue is related to insufficient authentication for the statistics collection service, which could allow a remote attacker to inject arbitrary values on an affected device. This could cause the web interface statistics view to present invalid data to users. The attacker could exploit this by sending properly formatted data values to the statistics collection service.

Recommendations For Cisco HyperFlex Software, ensure proper authentication is implemented for the statistics collection service to prevent unauthorized access. As a temporary workaround, consider restricting access to the statistics collection service until a patch is available. Avoid using the statistics collection service until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-345

Related Identifiers

BDU:2019-03994

CVE-2019-12620

Affected Products

Cisco Hyperflex

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2019-12620 · Security Note
• https://osv.dev/vulnerability/CVE-2019-12620 · Vendor Advisory
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190918-hyperflex-valinj · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-03994 · Security Note