CVE-2019-1666: Cisco HyperFlex Unauthenticated Statistics Retrieval Vulnerability
First published: Thu Feb 21 2019(Updated: )
A vulnerability in the Graphite service of Cisco HyperFlex software could allow an unauthenticated, remote attacker to retrieve data from the Graphite service. The vulnerability is due to insufficient authentication controls. An attacker could exploit this vulnerability by sending crafted requests to the Graphite service. A successful exploit could allow the attacker to retrieve any statistics from the Graphite service. Versions prior to 3.5(2a) are affected.
Credit: ykramarz@cisco.com ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco HyperFlex HX Data Platform | =2.6\(1a\) | |
| Cisco HyperFlex HX Data Platform | =2.6\(1b\) | |
| Cisco HyperFlex HX Data Platform | =2.6\(1d\) | |
| Cisco HyperFlex HX Data Platform | =2.6\(1e\) | |
| Cisco HyperFlex HX Data Platform | =3.0\(1a\) | |
| Cisco HyperFlex HX Data Platform | =3.0\(1b\) | |
| Cisco HyperFlex HX Data Platform | =3.0\(1c\) | |
| Cisco HyperFlex HX Data Platform | =3.0\(1d\) | |
| Cisco HyperFlex HX Data Platform | =3.0\(1e\) | |
| Cisco HyperFlex HX Data Platform | =3.0\(1h\) | |
| Cisco HyperFlex HX Data Platform | =3.0\(1i\) | |
| Cisco HyperFlex HX Data Platform | =3.5\(1a\) | |
| =2.6\(1a\) | ||
| =2.6\(1b\) | ||
| =2.6\(1d\) | ||
| =2.6\(1e\) | ||
| =3.0\(1a\) | ||
| =3.0\(1b\) | ||
| =3.0\(1c\) | ||
| =3.0\(1d\) | ||
| =3.0\(1e\) | ||
| =3.0\(1h\) | ||
| =3.0\(1i\) | ||
| =3.5\(1a\) |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID of this Cisco HyperFlex software vulnerability?
The vulnerability ID is CVE-2019-1666.
What is the severity level of CVE-2019-1666?
The severity level of CVE-2019-1666 is medium, with a severity value of 5.3.
How can an attacker exploit CVE-2019-1666?
An attacker can exploit CVE-2019-1666 by sending crafted requests to the Graphite service of the Cisco HyperFlex software.
Is authentication required to exploit CVE-2019-1666?
No, authentication is not required to exploit CVE-2019-1666.
Where can I find more information about CVE-2019-1666?
You can find more information about CVE-2019-1666 on the Cisco Security Advisory and SecurityFocus websites.
- collector/nvd-index
- agent/references
- agent/weakness
- agent/type
- agent/severity
- agent/title
- agent/description
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/last-modified-date
- agent/author
- agent/softwarecombine
- agent/tags
- agent/event
- vendor/cisco
- canonical/cisco hyperflex hx data platform
- version/cisco hyperflex hx data platform/2.6\(1a\)
- version/cisco hyperflex hx data platform/2.6\(1b\)
- version/cisco hyperflex hx data platform/2.6\(1d\)
- version/cisco hyperflex hx data platform/2.6\(1e\)
- version/cisco hyperflex hx data platform/3.0\(1a\)
- version/cisco hyperflex hx data platform/3.0\(1b\)
- version/cisco hyperflex hx data platform/3.0\(1c\)
- version/cisco hyperflex hx data platform/3.0\(1d\)
- version/cisco hyperflex hx data platform/3.0\(1e\)
- version/cisco hyperflex hx data platform/3.0\(1h\)
- version/cisco hyperflex hx data platform/3.0\(1i\)
- version/cisco hyperflex hx data platform/3.5\(1a\)