Cisco Secure Workload Unauthorized API Access Vulnerability
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- 1 proof of concept on GitHub
- Exploitation: none
- Automatable: yes
- Technical impact: total
Summary
A vulnerability in the access validation of internal REST APIs of Cisco Secure Workload could allow an unauthenticated, remote attacker to access site resources with the privileges of the Site Admin role. This vulnerability is due to insufficient validation and authentication when accessing REST API endpoints. An attacker could exploit this vulnerability if they are able to send a crafted API request to an affected endpoint. A successful exploit could allow the attacker to read sensitive information and make configuration changes across tenant boundaries with the privileges of the Site Admin user.
Timeline
- CISA SSVC assessment
Exploitation: none · Automatable: yes · Technical impact: total
- CVE published
- Record last updated
Affected versions
- Cisco Cisco Secure Workload
2.2.1.41, 3.2.1.18, 3.3.2.50, 3.4.1.28, 3.4.1.34, 2.3.1.45, 2.3.1.41, 3.3.2.28, 3.1.1.59, 2.0.2.20, 2.1.1.33, 2.1.1.29, 3.2.1.28, 3.4.1.35, 3.1.1.65, 3.1.1.67, 2.0.1.34, 2.3.1.49, 2.2.1.39, 3.4.1.19, 3.3.2.23, 3.1.1.61, 3.1.1.54, 3.5.1.17, 3.3.2.33, 3.5.1.1, 2.3.1.53, 3.5.1.20, 3.5.1.30, 3.3.2.16, and 69 more