CVE-2019-1857
Description
A vulnerability in the web-based management interface of Cisco HyperFlex HX-Series could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected system. The vulnerability is due to insufficient CSRF protections for the web-based management interface of the affected software. An attacker could exploit this vulnerability by persuading a user of the interface to follow a crafted link. A successful exploit could allow the attacker to perform arbitrary actions on an affected system by using a web browser and with the privileges of the user.
How to fix
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| cisco hx220c_m5_firmware | 3.0\(1a\) | — |
| cisco hx240c_m5_firmware | 3.0\(1a\) | — |
| cisco hx240c_large_form_factor_firmware | 3.0\(1a\) | — |
| cisco hx220c_all_nvme_m5_firmware | 3.0\(1a\) | — |
| cisco hx220c_af_m5_firmware | 3.0\(1a\) | — |
| cisco hx240c_af_m5_firmware | 3.0\(1a\) | — |
| cisco hx220c_edge_m5_firmware | 3.0\(1a\) | — |
| cisco ucs_b200_m5_firmware | 3.0\(1a\) | — |
| cisco ucs_b480_m5_firmware | 3.0\(1a\) | — |
| cisco ucs_c480_m5_firmware | 3.0\(1a\) | — |
| cisco ucs_c125_m5_firmware | 3.0\(1a\) | — |
| cisco ucs_c220_m5_firmware | 3.0\(1a\) | — |
| cisco ucs_c240_m5_firmware | 3.0\(1a\) | — |
| cisco ucs_c480_ml_firmware | 3.0\(1a\) | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.