CVE-2019-1975: medium-severity vulnerability in Cisco HyperFlex HX-Series
Cisco HyperFlex Software Cross-Frame Scripting Vulnerability
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.5epss 1.2%
A vulnerability in the web-based interface of Cisco HyperFlex Software could allow an unauthenticated, remote attacker to execute a cross-frame scripting (XFS) attack on an affected device. This vulnerability is due to insufficient HTML iframe protection. An attacker could exploit this vulnerability by directing a user to an attacker-controlled web page that contains a malicious HTML iframe. A successful exploit could allow the attacker to conduct clickjacking or other clientside browser attacks.
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Affected products
Cisco · Cisco HyperFlex HX-SeriesRelated CVEs — Cisco HyperFlex HX-Series
In the same product, most dangerous first.
CVE-2019-1666MEDIUMCisco HyperFlex Unauthenticated Statistics Retrieval VulnerabilityEPSS 2.2%CVE-2018-15382—Cisco HyperFlex Software Static Signing Key VulnerabilityEPSS 1.3%CVE-2018-15380HIGHCisco HyperFlex Software Command Injection VulnerabilityEPSS 1.1%CVE-2019-1665MEDIUMCisco Hyperflex Stored Cross-Site Scripting VulnerabilityEPSS 1.1%CVE-2018-15423—Cisco HyperFlex UI Clickjacking VulnerabilityEPSS 0.9%CVE-2019-12620MEDIUMCisco HyperFlex Software Counter Value Injection VulnerabilityEPSS 0.7%