CloudVision Portal vulnerabilities
9 known vulnerabilities in CloudVision Portal from Arista Networks. 9 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 8.4 High severity
CloudVision Portal: Improper Neutralization of Input During Web Page Generation
A missing input validation vulnerability in the Fileserver upload API allows an authenticated attacker with file upload privileges to execute stored cross-site scripting (XSS). Successful exploitation could enable the attacker to hijack another CloudVision use
- 9.1 Critical severity
CloudVision Portal: Improper Limitation of a Pathname to a Restricted Directory
An authenticated remote attacker with specific permissions can read or write files on the platform filesystem beyond the intended scope through specially crafted requests and/or crafted file uploads to the Software Management Studio Software Repository.
- 7.2 High severity
CloudVision Portal: Improper Limitation of a Pathname to a Restricted Directory
An authenticated remote attacker with specific permissions can read or write files on the platform filesystem beyond the intended scope through specially crafted requests and/or crafted file uploads to the Network Provisioning Image Repository.
- 8.0 High severity
CloudVision Portal: Improper Limitation of a Pathname to a Restricted Directory
On affected versions of CloudVision Portal (on-premises) or CloudVision Sensor, a path traversal vulnerability exists. An authenticated user with sufficient high privileges could exploit this to extract unintended data from the Sensor.
- 8.0 High severity
CloudVision Portal: URL Redirection to Untrusted Site
Insufficient validation in the Single Sign-On (SSO) login flow could allow a remote, unauthenticated attacker to craft a URL that, when clicked by a user, causes the identity provider (IdP) to deliver authentication material to an attacker-controlled URL inste
- 10.0 Critical severity
CloudVision Portal: Improper Privilege Management
On Arista CloudVision systems (virtual or physical on-premise deployments), Zero Touch Provisioning can be used to gain admin privileges on the CloudVision system, with more permissions than necessary, which can be used to query or manipulate system state for
- 9.1 Critical severity
CloudVision Portal: Cleartext Transmission of Sensitive Information
On affected platforms running Arista EOS with secure Vxlan configured, restarting the Tunnelsec agent will result in packets being sent over the secure Vxlan tunnels in the clear.
- 10.0 Critical severity
CloudVision Portal: Improper Authentication
On affected versions of the CloudVision Portal, improper access controls could enable a malicious authenticated user to take broader actions on managed EOS devices than intended. This advisory impacts the Arista CloudVision Portal products when run on-premise.
- 8.1 High severity
CloudVision: Incorrect Authorization
On affected versions of the CloudVision Portal improper access controls on the connection from devices to CloudVision could enable a malicious actor with network access to CloudVision to get broader access to telemetry and configuration data within the system