Lucene search

CiscoCVE-2018-15423

HistoryOct 05, 2018 - 2:29 p.m.

CVE-2018-15423

2018-10-0514:29:10

CWE-693

CWE-1021

cisco

web.nvd.nist.gov

cisco

hyperflex

software

vulnerability

web ui

clickjacking

attack

cve-2018-15423

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

4.7

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N

AI Score

4.8

Confidence

High

EPSS

0.001

Percentile

38.3%

JSON

A vulnerability in the web UI of Cisco HyperFlex Software could allow an unauthenticated, remote attacker to affect the integrity of a device via a clickjacking attack. The vulnerability is due to insufficient input validation of iFrame data in HTTP requests that are sent to an affected device. An attacker could exploit this vulnerability by sending crafted HTTP packets with malicious iFrame data. A successful exploit could allow the attacker to perform a clickjacking attack where the user is tricked into clicking a malicious link.

Affected configurations

Nvd

Node

ciscohyperflex_hx_data_platformMatch2.6\(1d\)

ciscohyperflex_hx_data_platformMatch3.0\(1a\)

VendorProductVersionCPE
ciscohyperflex_hx_data_platform2.6(1d)cpe:2.3:a:cisco:hyperflex_hx_data_platform:2.6\(1d\):*:*:*:*:*:*:*
ciscohyperflex_hx_data_platform3.0(1a)cpe:2.3:a:cisco:hyperflex_hx_data_platform:3.0\(1a\):*:*:*:*:*:*:*

Vendor	Product	Version	CPE
cisco	hyperflex_hx_data_platform	2.6(1d)	cpe:2.3:a:cisco:hyperflex_hx_data_platform:2.6\(1d\):::::::*
cisco	hyperflex_hx_data_platform	3.0(1a)	cpe:2.3:a:cisco:hyperflex_hx_data_platform:3.0\(1a\):::::::*

CNA Affected

[
  {
    "product": "Cisco HyperFlex HX-Series",
    "vendor": "Cisco",
    "versions": [
      {
        "status": "affected",
        "version": "n/a"
      }
    ]
  }
]

References

tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181003-hyperflex-clickjacking

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

4.7

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N

AI Score

4.8

Confidence

High

EPSS

0.001

Percentile

38.3%

JSON

Related for CVE-2018-15423