Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

nvd логотип

CVE-2019-1664

Опубликовано: 21 фев. 2019
Источник: nvd
CVSS3: 8.1
CVSS3: 7.8
CVSS2: 7.2
EPSS Низкий

Описание

A vulnerability in the hxterm service of Cisco HyperFlex Software could allow an unauthenticated, local attacker to gain root access to all nodes in the cluster. The vulnerability is due to insufficient authentication controls. An attacker could exploit this vulnerability by connecting to the hxterm service as a non-privileged, local user. A successful exploit could allow the attacker to gain root access to all member nodes of the HyperFlex cluster. This vulnerability affects Cisco HyperFlex Software Releases prior to 3.5(2a).

Ссылки

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:o:cisco:hyperflex_hx_data_platform:2.6\(1a\):*:*:*:*:*:*:*
cpe:2.3:o:cisco:hyperflex_hx_data_platform:2.6\(1b\):*:*:*:*:*:*:*
cpe:2.3:o:cisco:hyperflex_hx_data_platform:2.6\(1d\):*:*:*:*:*:*:*
cpe:2.3:o:cisco:hyperflex_hx_data_platform:2.6\(1e\):*:*:*:*:*:*:*
cpe:2.3:o:cisco:hyperflex_hx_data_platform:3.0\(1a\):*:*:*:*:*:*:*
cpe:2.3:o:cisco:hyperflex_hx_data_platform:3.0\(1b\):*:*:*:*:*:*:*
cpe:2.3:o:cisco:hyperflex_hx_data_platform:3.0\(1c\):*:*:*:*:*:*:*
cpe:2.3:o:cisco:hyperflex_hx_data_platform:3.0\(1d\):*:*:*:*:*:*:*
cpe:2.3:o:cisco:hyperflex_hx_data_platform:3.0\(1e\):*:*:*:*:*:*:*
cpe:2.3:o:cisco:hyperflex_hx_data_platform:3.0\(1h\):*:*:*:*:*:*:*
cpe:2.3:o:cisco:hyperflex_hx_data_platform:3.0\(1i\):*:*:*:*:*:*:*
cpe:2.3:o:cisco:hyperflex_hx_data_platform:3.5\(1a\):*:*:*:*:*:*:*

EPSS

Процентиль: 60%
0.00398
Низкий

8.1 High

CVSS3

7.8 High

CVSS3

7.2 High

CVSS2

Дефекты

CWE-284
CWE-287

Связанные уязвимости

github логотип

GHSA-jjrr-rj68-xhw3

CVSS3: 7.8
github
больше 3 лет назад

A vulnerability in the hxterm service of Cisco HyperFlex Software could allow an unauthenticated, local attacker to gain root access to all nodes in the cluster. The vulnerability is due to insufficient authentication controls. An attacker could exploit this vulnerability by connecting to the hxterm service as a non-privileged, local user. A successful exploit could allow the attacker to gain root access to all member nodes of the HyperFlex cluster. This vulnerability affects Cisco HyperFlex Software Releases prior to 3.5(2a).

fstec логотип

BDU:2019-01031

CVSS3: 8.1
fstec
почти 7 лет назад

Уязвимость компонента hxterm service гиперконвергентной инфраструктуры Cisco HyperFlex, позволяющая нарушителю повысить свои привилегии

EPSS

Процентиль: 60%
0.00398
Низкий

8.1 High

CVSS3

7.8 High

CVSS3

7.2 High

CVSS2

Дефекты

CWE-284
CWE-287