CVE-2018-15407 Cisco HyperFlex World-Readable Sensitive Information Vulnerability
An authenticated local attacker can read sensitive configuration data from residual installation files in Cisco HyperFlex.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-15407?
CVE-2018-15407 is a medium-severity vulnerability in Cisco HyperFlex HX-Series, published on 5 Oct 2018. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A vulnerability in the installation process of Cisco HyperFlex Software could allow an authenticated, local attacker to read sensitive information. The vulnerability is due to insufficient cleanup of installation files. An attacker could exploit this vulnerability by accessing the residual installation files on an affected system. A successful exploit could allow the attacker to collect sensitive information regarding the configuration of the system.
Which versions are affected by CVE-2018-15407?
It affects 1 product.
Products include Cisco Hyperflex Hx Data Platform.
How do I fix CVE-2018-15407?
No fix has been published for CVE-2018-15407 yet. Limit exposure of the affected software until one is available.
Is CVE-2018-15407 being exploited?
There is no known exploitation of CVE-2018-15407 in the wild and no public exploit code.
Other vulnerabilities in Cisco HyperFlex HX-Series
- CVE-2021-1497 Cisco HyperFlex HX Installer Virtual Machine Command Injection
- CVE-2021-1498 Cisco HyperFlex HX Data Platform Command Injection
- CVE-2018-15380 Cisco HyperFlex Software Command Injection Vulnerability
- CVE-2018-15382 Cisco HyperFlex Software Static Signing Key Vulnerability
- CVE-2019-1664 Cisco HyperFlex Software Unauthenticated Root Access Vulnerability
Sources
Also known as GHSA-qg7x-r68h-9889.