Description (CNA)
A vulnerability in the OpenAPI of Cisco Secure Workload could allow an authenticated, remote attacker with the privileges of a read-only user to execute operations that should require Administrator privileges. The attacker would need valid user credentials. This vulnerability is due to improper role-based access control (RBAC) of certain OpenAPI operations. An attacker could exploit this vulnerability by issuing a crafted OpenAPI function call with valid credentials. A successful exploit could allow the attacker to execute OpenAPI operations that are reserved for the Administrator user, including the creation and deletion of user labels.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Cisco / Cisco Secure Workload | affected 1.102.21; affected 1.103.1.12; affected 2.0.1.34; affected 2.0.2.20; affected 2.1.1.29; affected 2.1.1.31; affected 2.1.1.33; affected 2.2.1.34; affected 2.2.1.35; affected 2.2.1.39; affected 2.2.1.41; affected 2.3.1.41; affected 2.3.1.45; affected 2.3.1.49; affected 2.3.1.50; affected 2.3.1.51; affected 2.3.1.52; affected 2.3.1.53; affected 3.1.1.53; affected 3.1.1.54; affected 3.1.1.55; affected 3.1.1.59; affected 3.1.1.61; affected 3.1.1.65; affected 3.1.1.67; affected 3.1.1.70; affected 3.2.1.18; affected 3.2.1.19; affected 3.2.1.20; affected 3.2.1.28; affected 3.2.1.31; affected 3.2.1.32; affected 3.2.1.33; affected 3.3.2.12; affected 3.3.2.16; affected 3.3.2.2; affected 3.3.2.23; affected 3.3.2.28; affected 3.3.2.33; affected 3.3.2.35; affected 3.3.2.42; affected 3.3.2.5; affected 3.3.2.50; affected 3.3.2.53; affected 3.4.1.1; affected 3.4.1.14; affected 3.4.1.19; affected 3.4.1.20; affected 3.4.1.28; affected 3.4.1.34; affected 3.4.1.35; affected 3.4.1.6; affected 3.4.1.40; affected 3.5.1.1; affected 3.5.1.17; affected 3.5.1.2; affected 3.5.1.20; affected 3.5.1.23; affected 3.5.1.30; affected 3.5.1.31; affected 3.5.1.37; affected 3.6.1.17; affected 3.6.1.21; affected 3.6.1.36; affected 3.6.1.47; affected 3.6.1.5; affected 3.6.1.52; affected 3.7.1.22; affected 3.7.1.5 |
CWE
CWE-648
References
ADP enrichment
No English description supplied.