Auth bypass in Cisco Elastic Services Controller
CVE-2019-1867
A vulnerability in the REST API of Cisco Elastic Services Controller (ESC) could allow an unauthenticated, remote attacker to bypass authentication on the REST API. The vulnerability is due to improper validation of API requests. An attacker could exploit this vulnerability by sending a crafted request to the REST API. A successful exploit could allow the attacker to execute arbitrary actions through the REST API with administrative privileges on an affected system.
Vulnerability class: Broken Authentication
Published · last modified .
CVSS v3 metric
CVSS v3 base score 10.0 (Critical). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.303 (98.2th percentile), scored .
Moderate probability of exploitation in the next 30 days — watch for active exploitation reports. 98th percentile — 98.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.303 · newest: 0.303 · change: 0.000
Affected products
- Cisco Elastic Services Controller — versions unspecified, unspecified, unspecified
- Cisco Elastic Services Controller
Weakness classification (CWE)
References
- tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190507… (vendor-advisory, Vendor Advisory)
Frequently asked questions
- What is CVE-2019-1867?
- CVE-2019-1867 is a critical-severity vulnerability in Cisco Elastic Services Controller, classified under Improper Authentication. CVSS score: 10.0/10. Published 2019-05-10.
- How severe is CVE-2019-1867?
- Critical severity. CVSS v3 base score is 10.0 out of 10.