CVE-2019-18615: Medium severity arista cloudvision vulnerability
In CloudVision Portal (CVP) for all releases in the 2018.2 Train, under certain conditions, the application logs user passwords in plain text for certain API calls, potentially leading to user password exposure. This only affects CVP environments where: 1. Devices have enable mode passwords which are different from the user's login password, OR 2. There are configlet builders that use the Device class and specify username and password explicitly Application logs are not accessible or visible from the CVP GUI. Application logs can only be read by authorized users with privileged access to the VM hosting the CVP application.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-18615?
The severity of CVE-2019-18615 is considered high due to the potential exposure of user passwords.
How do I fix CVE-2019-18615?
To fix CVE-2019-18615, update the CloudVision Portal to a version later than 2018.2.3 that addresses this vulnerability.
What systems are affected by CVE-2019-18615?
CVE-2019-18615 affects all releases in the 2018.2 Train of the Arista CloudVision Portal when enable mode passwords are configured.
Can CVE-2019-18615 lead to data breaches?
Yes, CVE-2019-18615 can lead to data breaches as it may allow unauthorized access to user passwords stored in plain text.
Is CVE-2019-18615 a privileged user vulnerability?
Yes, CVE-2019-18615 primarily affects instances where privileged users make certain API calls that log passwords.