CVE-2019-1667 Cisco HyperFlex Arbitrary Statistics Write Vulnerability

What is CVE-2019-1667?

CVE-2019-1667 is a medium-severity missing authorization vulnerability in Cisco HyperFlex HX-Series, published on 21 Feb 2019. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

A vulnerability in the Graphite interface of Cisco HyperFlex software could allow an authenticated, local attacker to write arbitrary data to the Graphite interface. The vulnerability is due to insufficient authorization controls. An attacker could exploit this vulnerability by connecting to the Graphite service and sending arbitrary data. A successful exploit could allow the attacker to write arbitrary data to Graphite, which could result in invalid statistics being presented in the interface. Versions prior to 3.5(2a) are affected.

Weakness: CWE-863, CWE-345

Which versions are affected by CVE-2019-1667?

It affects 1 product.

Products include Cisco Hyperflex Hx Data Platform.

How do I fix CVE-2019-1667?

No fix has been published for CVE-2019-1667 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2019-1667 being exploited?

There is no known exploitation of CVE-2019-1667 in the wild and no public exploit code.

Other vulnerabilities in Cisco HyperFlex HX-Series

• CVE-2021-1497 Cisco HyperFlex HX Installer Virtual Machine Command Injection Exploited Critical 9.8
• CVE-2021-1498 Cisco HyperFlex HX Data Platform Command Injection Exploited Critical 9.8
• CVE-2018-15380 Cisco HyperFlex Software Command Injection Vulnerability High 8.8
• CVE-2018-15382 Cisco HyperFlex Software Static Signing Key Vulnerability High 8.6
• CVE-2019-1664 Cisco HyperFlex Software Unauthenticated Root Access Vulnerability High 8.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-4mrw-m8gp-8hgx.