CVE-2018-15382

HIGH Year: 2018
CVSS v3 Score
8.6
High
CVSS v2 Score
7.5
High
Weakness Type
CWE-642
View all →

Vulnerability Description

A vulnerability in Cisco HyperFlex Software could allow an unauthenticated, remote attacker to generate valid, signed session tokens. The vulnerability is due to a static signing key that is present in all Cisco HyperFlex systems. An attacker could exploit this vulnerability by accessing the static signing key from one HyperFlex system and using it to generate valid, signed session tokens for another HyperFlex system. A successful exploit could allow the attacker to access the HyperFlex Web UI of a system for which they are not authorized.

Related Vulnerabilities

CVE-2020-27872

HIGH
CVSS:8.8(High)

This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R7450 1.2.0.62_1.0.1 routers. Authentication is not required to exploit this vulnerab...

CWE-6422020

CVE-2024-8754

HIGH
CVSS:8.1(High)

An issue has been discovered in GitLab EE/CE affecting all versions from 16.9.7 prior to 17.1.7, 17.2 prior to 17.2.5, and 17.3 prior to 17.3.2. An improper input validation error allows attacker to s...

CWE-6422024

CVE-2019-9496

HIGH
CVSS:7.5(High)

An invalid authentication sequence could result in the hostapd process terminating due to missing state validation steps when processing the SAE confirm message when in hostapd/AP mode. All version of...

CWE-6422019

CVE-2020-26186

MEDIUM
CVSS:6.8(Medium)

Dell Inspiron 5675 BIOS versions prior to 1.4.1 contain a UEFI BIOS RuntimeServices overwrite vulnerability. A local attacker with access to system memory may exploit this vulnerability by overwriting...

CWE-6422020

CVE-2022-22154

MEDIUM
CVSS:6.8(Medium)

In a Junos Fusion scenario an External Control of Critical State Data vulnerability in the Satellite Device (SD) control state machine of Juniper Networks Junos OS allows an attacker who is able to ma...

CWE-6422022

CVE-2024-22387

MEDIUM
CVSS:6.8(Medium)

External Control of Critical State Data (CWE-642) in the Controller 6000 and Controller 7000 diagnostic web interface allows an authenticated user to modify device I/O connections leading to unexpecte...

CWE-6422024