6.5

CVE-2019-1975

A vulnerability in the web-based interface of Cisco HyperFlex Software could allow an unauthenticated, remote attacker to execute a cross-frame scripting (XFS) attack on an affected device. This vulnerability is due to insufficient HTML iframe protection. An attacker could exploit this vulnerability by directing a user to an attacker-controlled web page that contains a malicious HTML iframe. A successful exploit could allow the attacker to conduct clickjacking or other clientside browser attacks.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Cisco ≫ Hyperflex Hx220c M5 Firmware Version <= 3.5.2f
   Cisco ≫ Hyperflex Hx220c M5 Version-
Cisco ≫ Hyperflex Hx220c M5 Firmware Version4.0(1a)
   Cisco ≫ Hyperflex Hx220c M5 Version-
Cisco ≫ Hyperflex Hx240c M5 Firmware Version <= 3.5.2f
   Cisco ≫ Hyperflex Hx240c M5 Version-
Cisco ≫ Hyperflex Hx240c M5 Firmware Version4.0(1a)
   Cisco ≫ Hyperflex Hx240c M5 Version-
Cisco ≫ Hyperflex Hx220c Af M5 Firmware Version <= 3.5.2f
   Cisco ≫ Hyperflex Hx220c Af M5 Version-
Cisco ≫ Hyperflex Hx220c Af M5 Firmware Version4.0(1a)
   Cisco ≫ Hyperflex Hx220c Af M5 Version-
Cisco ≫ Hyperflex Hx240c Af M5 Firmware Version <= 3.5.2f
   Cisco ≫ Hyperflex Hx240c Af M5 Version-
Cisco ≫ Hyperflex Hx240c Af M5 Firmware Version4.0(1a)
   Cisco ≫ Hyperflex Hx240c Af M5 Version-
Cisco ≫ Hyperflex Hx220c Edge M5 Firmware Version <= 3.5.2f
   Cisco ≫ Hyperflex Hx220c Edge M5 Version-
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.47% 0.618
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 6.1 2.8 2.7
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
nvd@nist.gov 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:N/I:P/A:N
psirt@cisco.com 6.5 2.8 3.6
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
CWE-1021 Improper Restriction of Rendered UI Layers or Frames

The web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain, which can lead to user confusion about which interface the user is interacting with.

CWE-693 Protection Mechanism Failure

The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.