Medium severity · published Feb 21, 2019
CVE-2019-1666
Cisco HyperFlex Unauthenticated Statistics Retrieval Vulnerability
5.3
CVSS
2.2%
EPSS
No
On KEV
Description
A vulnerability in the Graphite service of Cisco HyperFlex software could allow an unauthenticated, remote attacker to retrieve data from the Graphite service. The vulnerability is due to insufficient authentication controls. An attacker could exploit this vulnerability by sending crafted requests to the Graphite service. A successful exploit could allow the attacker to retrieve any statistics from the Graphite service. Versions prior to 3.5(2a) are affected.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.2% · higher than 83% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CH
Cisco HyperFlex HX-Series · Cisco
before 3.5(2a) · source: vendor
HH
Hyperflex HX Data Platform · Cisco
2.6(1a); 2.6(1b); 2.6(1d); 2.6(1e); 3.0(1a); 3.0(1b); +6 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-1666
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-1666
Third Party Advisory
http://www.securityfocus.com/bid/107108
Vendor Advisory
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190220-hyper-retrieve
More from Cisco HyperFlex HX-Series
8.8
CVE-2018-15380
Cisco HyperFlex Software Command Injection Vulnerability
7.8
CVE-2019-1664
Cisco HyperFlex Software Unauthenticated Root Access Vulnerability
6.1
CVE-2019-1665
Cisco Hyperflex Stored Cross-Site Scripting Vulnerability
3.3
CVE-2019-1667
Cisco HyperFlex Arbitrary Statistics Write Vulnerability