Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.8
CVE-2019-1958: Cisco HyperFlex web UI lets remote attacker act as user
CVE-2019-1958 · published 7 years ago
Summary
The web‑based management console in Cisco HyperFlex can be tricked into performing actions on behalf of a logged‑in user without any authentication. An attacker who convinces a user to click a malicious link could carry out any task that user is allowed to do, such as changing settings or accessing data. Apply the latest software update and limit access to the management interface to trusted networks and users.
What to do
- Update cisco hyperflex_hx_data_platform to version 4.0\(2a\) or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| cisco | hyperflex_hx_data_platform |
< 4.0\(2a\) cpe:2.3:o:cisco:hyperflex_hx_data_platform:*:*:*:*:*:*:*:* |
Original advisory text
A vulnerability in the web-based management interface of Cisco HyperFlex Software could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affecte...
A vulnerability in the web-based management interface of Cisco HyperFlex Software could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system. The vulnerability is due to insufficient CSRF protections for the web UI on an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to follow a malicious link. A successful exploit could allow the attacker to perform arbitrary actions with the privilege level of the affected user.
References
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-352Cross-Site Request Forgery (CSRF)
Timeline
Published8 Aug 2019
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2019-1958 · NVD
Track software like this
Free during beta