CVE-2018-15382 Cisco HyperFlex Software Static Signing Key Vulnerability
An attacker can use a static signing key to generate valid session tokens and gain unauthorized access to the HyperFlex Web UI.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-15382?
CVE-2018-15382 is a high-severity vulnerability in Cisco HyperFlex HX-Series, published on 5 Oct 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability in Cisco HyperFlex Software could allow an unauthenticated, remote attacker to generate valid, signed session tokens. The vulnerability is due to a static signing key that is present in all Cisco HyperFlex systems. An attacker could exploit this vulnerability by accessing the static signing key from one HyperFlex system and using it to generate valid, signed session tokens for another HyperFlex system. A successful exploit could allow the attacker to access the HyperFlex Web UI of a system for which they are not authorized.
Weakness: CWE-642
Which versions are affected by CVE-2018-15382?
It affects 1 product.
Products include Cisco Hyperflex Hx Data Platform.
How do I fix CVE-2018-15382?
No fix has been published for CVE-2018-15382 yet. Limit exposure of the affected software until one is available.
Is CVE-2018-15382 being exploited?
There is no known exploitation of CVE-2018-15382 in the wild and no public exploit code.
Other vulnerabilities in Cisco HyperFlex HX-Series
- CVE-2021-1497 Cisco HyperFlex HX Installer Virtual Machine Command Injection
- CVE-2021-1498 Cisco HyperFlex HX Data Platform Command Injection
- CVE-2018-15380 Cisco HyperFlex Software Command Injection Vulnerability
- CVE-2019-1664 Cisco HyperFlex Software Unauthenticated Root Access Vulnerability
- CVE-2017-12315 Information disclosure in Cisco HyperFlex System
Sources
Also known as GHSA-w2hw-vrcc-cpx9.