CVE-2019-1666: medium-severity vulnerability in Cisco HyperFlex HX-Series
Cisco HyperFlex Unauthenticated Statistics Retrieval Vulnerability
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.3epss 2.2%
A vulnerability in the Graphite service of Cisco HyperFlex software could allow an unauthenticated, remote attacker to retrieve data from the Graphite service. The vulnerability is due to insufficient authentication controls. An attacker could exploit this vulnerability by sending crafted requests to the Graphite service. A successful exploit could allow the attacker to retrieve any statistics from the Graphite service. Versions prior to 3.5(2a) are affected.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected products
Cisco · Cisco HyperFlex HX-SeriesRelated CVEs — Cisco HyperFlex HX-Series
In the same product, most dangerous first.
CVE-2018-15382—Cisco HyperFlex Software Static Signing Key VulnerabilityEPSS 1.3%CVE-2019-1975MEDIUMCisco HyperFlex Software Cross-Frame Scripting VulnerabilityEPSS 1.2%CVE-2018-15380HIGHCisco HyperFlex Software Command Injection VulnerabilityEPSS 1.1%CVE-2019-1665MEDIUMCisco Hyperflex Stored Cross-Site Scripting VulnerabilityEPSS 1.1%CVE-2018-15423—Cisco HyperFlex UI Clickjacking VulnerabilityEPSS 0.9%CVE-2019-12620MEDIUMCisco HyperFlex Software Counter Value Injection VulnerabilityEPSS 0.7%