Read the docs
TI-2017-09091 Aliases CVE-2017-12315GHSA-wgm8-4c2w-8672

Information disclosure in Cisco HyperFlex System

Priority LOW 27CWE-200Published · Updated

Key facts

Attack vector
Local
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-200.

Summary

A vulnerability in system logging when replication is being configured with the Cisco HyperFlex System could allow an authenticated, local attacker to view sensitive information that should be restricted in the system log files. The attacker would have to be authenticated as an administrative user to conduct this attack. The vulnerability is due to lack of proper masking of sensitive information in system log files. An attacker could exploit this vulnerability by authenticating to the targeted device and viewing the system log file. An exploit could allow the attacker to view sensitive system information that should have been restricted. The attacker could use this information to conduct additional reconnaissance attacks. Cisco Bug IDs: CSCvg31472.

Why it matters now

EPSS 0.00326 25th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—Cisco HyperFlex SystemCisco HyperFlex System—No fix listedCNA
  • Cisco HyperFlex System Vendor— Affected Cisco HyperFlex System Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:o:cisco:hyperflex_hx_data_platform:2.6\(1a\):*:*:*:*:*:*:*2.6(1a)VulnerableCisco
  • cpe:2.3:o:cisco:hyperflex_hx_data_platform:2.6\(1a\):*:*:*:*:*:*:* Versions 2.6(1a) Vulnerable ·Cisco

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-12315
  2. 2026-10-03 Alias added: GHSA-wgm8-4c2w-8672

References

Advisory 1

  • TI-2021-01225 Cisco HyperFlex HX Command Injection Vulnerabilities KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-01224 Cisco HyperFlex HX Command Injection Vulnerabilities KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-01226 Cisco HyperFlex HX Data Platform File Upload Vulnerability CVSS 3.1MEDIUM 5.3
  • TI-2018-10944 Cisco HyperFlex Software Static Signing Key Vulnerability CVSS 3.0HIGH 8.6
  • TI-2018-10942 Cisco HyperFlex Software Command Injection Vulnerability CVSS 3.0HIGH 8.8
  • TI-2019-01578 Cisco HyperFlex Software Cross-Site Request Forgery Vulnerability CVSS 3.1HIGH 8.8
See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences