CVE-2019-1857
8.8
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Exploitability: 2.8 / Impact: 5.9
Source: NVD
Description
A vulnerability in the web-based management interface of Cisco HyperFlex HX-Series could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected system. The vulnerability is due to insufficient CSRF protections for the web-based management interface of the affected software. An attacker could exploit this vulnerability by persuading a user of the interface to follow a crafted link. A successful exploit could allow the attacker to perform arbitrary actions on an affected system by using a web browser and with the privileges of the user.
Affected (14)
Products: Cisco: Hx220c M5 Firmware, Hx240c M5 Firmware, Hx240c Large Form Factor Firmware, Hx220c All Nvme M5 Firmware, Hx220c Af M5 Firmware, Hx240c Af M5 Firmware, Hx220c Edge M5 Firmware, Ucs B200 M5 Firmware, Ucs B480 M5 Firmware, Ucs C480 M5 Firmware, Ucs C125 M5 Firmware, Ucs C220 M5 Firmware, Ucs C240 M5 Firmware, Ucs C480 Ml Firmware
Configuration A
| Vulnerable Software | Affected Versions |
|---|---|
| Version 3.0(1a) |
| Running on/with | Platform Versions |
|---|---|
Cisco Hx220c M5 | All versions |
Configuration B
| Vulnerable Software | Affected Versions |
|---|---|
| Version 3.0(1a) |
| Running on/with | Platform Versions |
|---|---|
Cisco Hx240c M5 | All versions |
Configuration C
| Vulnerable Software | Affected Versions |
|---|---|
| Version 3.0(1a) |
| Running on/with | Platform Versions |
|---|---|
Cisco Hx240c Large Form Factor | All versions |
Configuration D
| Vulnerable Software | Affected Versions |
|---|---|
| Version 3.0(1a) |
| Running on/with | Platform Versions |
|---|---|
Cisco Hx220c All Nvme M5 | All versions |
Configuration E
| Vulnerable Software | Affected Versions |
|---|---|
| Version 3.0(1a) |
| Running on/with | Platform Versions |
|---|---|
Cisco Hx220c Af M5 | All versions |
Configuration F
| Vulnerable Software | Affected Versions |
|---|---|
| Version 3.0(1a) |
| Running on/with | Platform Versions |
|---|---|
Cisco Hx240c Af M5 | All versions |
Configuration G
| Vulnerable Software | Affected Versions |
|---|---|
| Version 3.0(1a) |
| Running on/with | Platform Versions |
|---|---|
Cisco Hx220c Edge M5 | All versions |
Configuration H
| Vulnerable Software | Affected Versions |
|---|---|
| Version 3.0(1a) |
| Running on/with | Platform Versions |
|---|---|
Cisco Ucs B200 M5 | All versions |
Configuration I
| Vulnerable Software | Affected Versions |
|---|---|
| Version 3.0(1a) |
| Running on/with | Platform Versions |
|---|---|
Cisco Ucs B480 M5 | All versions |
Configuration J
| Vulnerable Software | Affected Versions |
|---|---|
| Version 3.0(1a) |
| Running on/with | Platform Versions |
|---|---|
Cisco Ucs C480 M5 | All versions |
Configuration K
| Vulnerable Software | Affected Versions |
|---|---|
| Version 3.0(1a) |
| Running on/with | Platform Versions |
|---|---|
Cisco Ucs C125 M5 | All versions |
Configuration L
| Vulnerable Software | Affected Versions |
|---|---|
| Version 3.0(1a) |
| Running on/with | Platform Versions |
|---|---|
Cisco Ucs C220 M5 | All versions |
Configuration M
| Vulnerable Software | Affected Versions |
|---|---|
| Version 3.0(1a) |
| Running on/with | Platform Versions |
|---|---|
Cisco Ucs C240 M5 | All versions |
Configuration N
| Vulnerable Software | Affected Versions |
|---|---|
| Version 3.0(1a) |
| Running on/with | Platform Versions |
|---|---|
Cisco Ucs C480 Ml | All versions |
References (4)
Source: psirt@cisco.com
Source: psirt@cisco.com
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
Timeline
No history available yet.