CVE-2019-19631

Vulnerability

An issue in Big Switch Big Monitoring Fabric, Big Cloud Fabric, and Multi-Cloud Director allows a read-only user to access an API endpoint that reveals session cookies of authenticated administrators [1]. Affected versions: Big Monitoring Fabric 6.2 through 6.2.4, 6.3 through 6.3.9, 7.0 through 7.0.3, and 7.1 through 7.1.3; Big Cloud Fabric 4.5 through 4.5.5, 4.7 through 4.7.7, 5.0 through 5.0.1, and 5.1 through 5.1.4; Multi-Cloud Director through 1.1.0.

Exploitation

An attacker with a read-only user account can access the vulnerable API endpoint to retrieve session cookies of authenticated administrators [1]. No additional authentication or user interaction is required beyond possessing a valid read-only account. The attacker can then use the stolen cookies to impersonate an administrator.

Impact

Successful exploitation allows the attacker to escalate privileges from read-only to administrative, gaining full control over the application and potentially SSH console access to the affected system [1].

Mitigation

Fixed versions are available: Big Monitoring Fabric 7.1.4, Big Cloud Fabric 5.1.4, and Multi-Cloud Director 1.1.0 [1]. Users should upgrade to these versions or later to remediate the vulnerability. No workarounds have been published.