Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2019-18615

In CloudVision Portal (CVP) for all releases in the 2018.2 Train, under certain conditions, the application logs user passwords in plain text for certain API calls, potentially leading to user password exposure. This only affects CVP environments where: 1. Devices have enable mode passwords which are different from the user's login password, OR 2. There are configlet builders that use the Device class and specify username and password explicitly Application logs are not accessible or visible from the CVP GUI. Application logs can only be read by authorized users with privileged access to the VM hosting the CVP application.

Published

2019-12-19T17:15:12.543

Last Modified

2024-11-21T04:33:22.163

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 4.9 (MEDIUM)

CVSSv2 Vector

AV:N/AC:M/Au:S/C:P/I:N/A:N

Access Vector: NETWORK
Access Complexity: MEDIUM
Authentication: SINGLE
Confidentiality Impact: PARTIAL
Integrity Impact: NONE
Availability Impact: NONE

Exploitability Score

6.8

Impact Score

2.9

Weaknesses

Type: Primary
CWE-312
CWE-522

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	arista	cloudvision_portal	≤ 2018.2.3	Yes

References

https://www.arista.com/en/support/advisories-notices/security-advisories/9002-security-advisory-45 Vendor Advisory ([email protected])
https://www.arista.com/en/support/advisories-notices/security-advisories/9002-security-advisory-45 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)