CVE-2019-1975: falha de média gravidade em Cisco HyperFlex HX-Series
Cisco HyperFlex Software Cross-Frame Scripting Vulnerability
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.5epss 1.2%
A vulnerability in the web-based interface of Cisco HyperFlex Software could allow an unauthenticated, remote attacker to execute a cross-frame scripting (XFS) attack on an affected device. This vulnerability is due to insufficient HTML iframe protection. An attacker could exploit this vulnerability by directing a user to an attacker-controlled web page that contains a malicious HTML iframe. A successful exploit could allow the attacker to conduct clickjacking or other clientside browser attacks.
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Produtos afetados
Cisco · Cisco HyperFlex HX-SeriesCVEs relacionadas — Cisco HyperFlex HX-Series
No mesmo produto, das mais perigosas para as menos.
CVE-2019-1666MEDIUMCisco HyperFlex Unauthenticated Statistics Retrieval VulnerabilityEPSS 2.2%CVE-2018-15382—Cisco HyperFlex Software Static Signing Key VulnerabilityEPSS 1.3%CVE-2018-15380HIGHCisco HyperFlex Software Command Injection VulnerabilityEPSS 1.1%CVE-2019-1665MEDIUMCisco Hyperflex Stored Cross-Site Scripting VulnerabilityEPSS 1.1%CVE-2018-15423—Cisco HyperFlex UI Clickjacking VulnerabilityEPSS 0.9%CVE-2019-12620MEDIUMCisco HyperFlex Software Counter Value Injection VulnerabilityEPSS 0.7%