github - ghsa-j98g-g34p-r4ch

ghsa-j98g-g34p-r4ch

Vulnerability from github

Published

2023-06-28 15:30

Modified

2023-06-28 15:30

Severity ?

4.3 (Medium) - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Details

A vulnerability in the OpenAPI of Cisco Secure Workload could allow an authenticated, remote attacker with the privileges of a read-only user to execute operations that should require Administrator privileges. The attacker would need valid user credentials. This vulnerability is due to improper role-based access control (RBAC) of certain OpenAPI operations. An attacker could exploit this vulnerability by issuing a crafted OpenAPI function call with valid credentials. A successful exploit could allow the attacker to execute OpenAPI operations that are reserved for the Administrator user, including the creation and deletion of user labels.

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2023-20136"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269",
      "CWE-648"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-06-28T15:15:09Z",
    "severity": "MODERATE"
  },
  "details": "A vulnerability in the OpenAPI of Cisco Secure Workload could allow an authenticated, remote attacker with the privileges of a read-only user to execute operations that should require Administrator privileges. The attacker would need valid user credentials. This vulnerability is due to improper role-based access control (RBAC) of certain OpenAPI operations. An attacker could exploit this vulnerability by issuing a crafted OpenAPI function call with valid credentials. A successful exploit could allow the attacker to execute OpenAPI operations that are reserved for the Administrator user, including the creation and deletion of user labels.",
  "id": "GHSA-j98g-g34p-r4ch",
  "modified": "2023-06-28T15:30:23Z",
  "published": "2023-06-28T15:30:23Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-20136"
    },
    {
      "type": "WEB",
      "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-csw-auth-openapi-kTndjdNX"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2023-20136 (GCVE-0-2023-20136)

Vulnerability from cvelistv5

Published

2023-06-28 00:00

Modified

2024-08-02 08:57

Severity ?

4.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

CWE

CWE-648 - Incorrect Use of Privileged APIs

Summary

References

URL

Tags

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-csw-auth-openapi-kTndjdNX

Impacted products

	Vendor	Product	Version
	Cisco	Cisco Secure Workload	Version: 1.102.21 Version: 1.103.1.12 Version: 2.0.1.34 Version: 2.0.2.20 Version: 2.1.1.29 Version: 2.1.1.31 Version: 2.1.1.33 Version: 2.2.1.34 Version: 2.2.1.35 Version: 2.2.1.39 Version: 2.2.1.41 Version: 2.3.1.41 Version: 2.3.1.45 Version: 2.3.1.49 Version: 2.3.1.50 Version: 2.3.1.51 Version: 2.3.1.52 Version: 2.3.1.53 Version: 3.1.1.53 Version: 3.1.1.54 Version: 3.1.1.55 Version: 3.1.1.59 Version: 3.1.1.61 Version: 3.1.1.65 Version: 3.1.1.67 Version: 3.1.1.70 Version: 3.2.1.18 Version: 3.2.1.19 Version: 3.2.1.20 Version: 3.2.1.28 Version: 3.2.1.31 Version: 3.2.1.32 Version: 3.2.1.33 Version: 3.3.2.12 Version: 3.3.2.16 Version: 3.3.2.2 Version: 3.3.2.23 Version: 3.3.2.28 Version: 3.3.2.33 Version: 3.3.2.35 Version: 3.3.2.42 Version: 3.3.2.5 Version: 3.3.2.50 Version: 3.3.2.53 Version: 3.4.1.1 Version: 3.4.1.14 Version: 3.4.1.19 Version: 3.4.1.20 Version: 3.4.1.28 Version: 3.4.1.34 Version: 3.4.1.35 Version: 3.4.1.6 Version: 3.4.1.40 Version: 3.5.1.1 Version: 3.5.1.17 Version: 3.5.1.2 Version: 3.5.1.20 Version: 3.5.1.23 Version: 3.5.1.30 Version: 3.5.1.31 Version: 3.5.1.37 Version: 3.6.1.17 Version: 3.6.1.21 Version: 3.6.1.36 Version: 3.6.1.47 Version: 3.6.1.5 Version: 3.6.1.52 Version: 3.7.1.22 Version: 3.7.1.5

Show details on NVD website