title: HyperCloud: "admin" and "serveradmin" users can be deleted
description: An Improper Privilege Management vulnerability exists in HyperCloud that will impact the ability for a user to authenticate against the management plane.
An authenticated admin-level user may be able to delete the "admin" or "serveradmin" users, which prevents authentication from subsequently succeeding.
This issue affects HyperCloud versions 1.0 to any release before 2.1.
problem types: CWE-269 Improper Privilege Management
affected:
{
defaultStatus: unaffected
product: HyperCloud
vendor: SoftIron
versions:
lessThan: 2.1, status: affected, version: 1.0, versionType: semver
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 4.2
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL