Read the docs
TI-2019-01291 Aliases CVE-2019-1665GHSA-55q5-vmf8-xcfc

Cisco Hyperflex Stored Cross-Site Scripting Vulnerability

Priority LOW 29CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

A vulnerability in the web-based management interface of Cisco HyperFlex software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected system. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected system. An attacker could exploit this vulnerability by persuading a user of the interface to click a maliciously crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. Versions prior to 3.5(1a) are affected.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01094 65th percentileScored 2026-11-07
Fix Fixed Cisco HyperFlex HX-Series (Cisco): 3.5(1a)

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
CiscoCisco HyperFlex HX-Seriesbefore 3.5(1a)3.5(1a)Patch availableCNA
  • Cisco HyperFlex HX-Series VendorCisco Affected before 3.5(1a) Fixed in 3.5(1a) Patch available CNA

CPE configurations NVD · 11

CPEVersionsRoleVendor
cpe:2.3:o:cisco:hyperflex_hx_data_platform:2.6\(1a\):*:*:*:*:*:*:*2.6(1a)VulnerableCisco
cpe:2.3:o:cisco:hyperflex_hx_data_platform:2.6\(1b\):*:*:*:*:*:*:*2.6(1b)VulnerableCisco
cpe:2.3:o:cisco:hyperflex_hx_data_platform:2.6\(1d\):*:*:*:*:*:*:*2.6(1d)VulnerableCisco
cpe:2.3:o:cisco:hyperflex_hx_data_platform:2.6\(1e\):*:*:*:*:*:*:*2.6(1e)VulnerableCisco
cpe:2.3:o:cisco:hyperflex_hx_data_platform:3.0\(1a\):*:*:*:*:*:*:*3.0(1a)VulnerableCisco
cpe:2.3:o:cisco:hyperflex_hx_data_platform:3.0\(1b\):*:*:*:*:*:*:*3.0(1b)VulnerableCisco
cpe:2.3:o:cisco:hyperflex_hx_data_platform:3.0\(1c\):*:*:*:*:*:*:*3.0(1c)VulnerableCisco
cpe:2.3:o:cisco:hyperflex_hx_data_platform:3.0\(1d\):*:*:*:*:*:*:*3.0(1d)VulnerableCisco
cpe:2.3:o:cisco:hyperflex_hx_data_platform:3.0\(1e\):*:*:*:*:*:*:*3.0(1e)VulnerableCisco
cpe:2.3:o:cisco:hyperflex_hx_data_platform:3.0\(1h\):*:*:*:*:*:*:*3.0(1h)VulnerableCisco
  • cpe:2.3:o:cisco:hyperflex_hx_data_platform:2.6\(1a\):*:*:*:*:*:*:* Versions 2.6(1a) Vulnerable ·Cisco
  • cpe:2.3:o:cisco:hyperflex_hx_data_platform:2.6\(1b\):*:*:*:*:*:*:* Versions 2.6(1b) Vulnerable ·Cisco
  • cpe:2.3:o:cisco:hyperflex_hx_data_platform:2.6\(1d\):*:*:*:*:*:*:* Versions 2.6(1d) Vulnerable ·Cisco
  • cpe:2.3:o:cisco:hyperflex_hx_data_platform:2.6\(1e\):*:*:*:*:*:*:* Versions 2.6(1e) Vulnerable ·Cisco
  • cpe:2.3:o:cisco:hyperflex_hx_data_platform:3.0\(1a\):*:*:*:*:*:*:* Versions 3.0(1a) Vulnerable ·Cisco
  • cpe:2.3:o:cisco:hyperflex_hx_data_platform:3.0\(1b\):*:*:*:*:*:*:* Versions 3.0(1b) Vulnerable ·Cisco
  • cpe:2.3:o:cisco:hyperflex_hx_data_platform:3.0\(1c\):*:*:*:*:*:*:* Versions 3.0(1c) Vulnerable ·Cisco
  • cpe:2.3:o:cisco:hyperflex_hx_data_platform:3.0\(1d\):*:*:*:*:*:*:* Versions 3.0(1d) Vulnerable ·Cisco
  • cpe:2.3:o:cisco:hyperflex_hx_data_platform:3.0\(1e\):*:*:*:*:*:*:* Versions 3.0(1e) Vulnerable ·Cisco
  • cpe:2.3:o:cisco:hyperflex_hx_data_platform:3.0\(1h\):*:*:*:*:*:*:* Versions 3.0(1h) Vulnerable ·Cisco
Show 1 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:cisco:hyperflex_hx_data_platform:3.0\(1i\):*:*:*:*:*:*:*3.0(1i)VulnerableCisco
  • cpe:2.3:o:cisco:hyperflex_hx_data_platform:3.0\(1i\):*:*:*:*:*:*:* Versions 3.0(1i) Vulnerable ·Cisco

Remediation

  • Fix · CNA Cisco HyperFlex HX-Series (Cisco) Fixed in 3.5(1a)

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-1665
  2. 2026-10-03 Alias added: GHSA-55q5-vmf8-xcfc

References

Advisory 1

  • TI-2021-01225 Cisco HyperFlex HX Command Injection Vulnerabilities KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-01224 Cisco HyperFlex HX Command Injection Vulnerabilities KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-01226 Cisco HyperFlex HX Data Platform File Upload Vulnerability CVSS 3.1MEDIUM 5.3
  • TI-2018-10944 Cisco HyperFlex Software Static Signing Key Vulnerability CVSS 3.0HIGH 8.6
  • TI-2018-10942 Cisco HyperFlex Software Command Injection Vulnerability CVSS 3.0HIGH 8.8
  • TI-2019-01578 Cisco HyperFlex Software Cross-Site Request Forgery Vulnerability CVSS 3.1HIGH 8.8
See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences