TI-2018-10983 Aliases CVE-2018-15423 GHSA-9g5x-wr2w-vx7m

Cisco HyperFlex UI Clickjacking Vulnerability

LOW 23CWE-693Published 2018-10-05 · Updated 2024-11-26

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Security bypass, Spoofing
Confidentiality · integrity · availability: None · Low · None
Fix status: No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-693 and CWE-1021.

Summary

A vulnerability in the web UI of Cisco HyperFlex Software could allow an unauthenticated, remote attacker to affect the integrity of a device via a clickjacking attack. The vulnerability is due to insufficient input validation of iFrame data in HTTP requests that are sent to an affected device. An attacker could exploit this vulnerability by sending crafted HTTP packets with malicious iFrame data. A successful exploit could allow the attacker to perform a clickjacking attack where the user is tricked into clicking a malicious link.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00922 60th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Cisco	Cisco HyperFlex HX-Series	all versions	—	No fix listed	CNA

Cisco HyperFlex HX-Series VendorCisco Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:cisco:hyperflex_hx_data_platform:2.6\(1d\):::::::*	2.6(1d)	Vulnerable	Cisco
cpe:2.3:a:cisco:hyperflex_hx_data_platform:3.0\(1a\):::::::*	3.0(1a)	Vulnerable	Cisco

cpe:2.3:a:cisco:hyperflex_hx_data_platform:2.6\(1d\):*:*:*:*:*:*:* Versions 2.6(1d) Vulnerable ·Cisco
cpe:2.3:a:cisco:hyperflex_hx_data_platform:3.0\(1a\):*:*:*:*:*:*:* Versions 3.0(1a) Vulnerable ·Cisco

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2018-15423
2026-10-03 Alias added: GHSA-9g5x-wr2w-vx7m

References

Advisory 1

20181003 Cisco HyperFlex UI Clickjacking Vulnerability

TI-2021-01225 Cisco HyperFlex HX Command Injection Vulnerabilities KEVCVSS 3.1CRITICAL 9.8
TI-2021-01224 Cisco HyperFlex HX Command Injection Vulnerabilities KEVCVSS 3.1CRITICAL 9.8
TI-2021-01226 Cisco HyperFlex HX Data Platform File Upload Vulnerability CVSS 3.1MEDIUM 5.3
TI-2018-10944 Cisco HyperFlex Software Static Signing Key Vulnerability CVSS 3.0HIGH 8.6
TI-2018-10942 Cisco HyperFlex Software Command Injection Vulnerability CVSS 3.0HIGH 8.8
TI-2019-01578 Cisco HyperFlex Software Cross-Site Request Forgery Vulnerability CVSS 3.1HIGH 8.8

See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences