CVE-2023-20136

Published Jun 28, 2023 CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Description

A vulnerability in the OpenAPI of Cisco Secure Workload could allow an authenticated, remote attacker with the privileges of a read-only user to execute operations that should require Administrator privileges. The attacker would need valid user credentials.

This vulnerability is due to improper role-based access control (RBAC) of certain OpenAPI operations. An attacker could exploit this vulnerability by issuing a crafted OpenAPI function call with valid credentials. A successful exploit could allow the attacker to execute OpenAPI operations that are reserved for the Administrator user, including the creation and deletion of user labels.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Cisco

Cisco Secure Workload

affected

Version	Status	Constraints
`1.102.21`	affected	—
`1.103.1.12`	affected	—
`2.0.1.34`	affected	—
`2.0.2.20`	affected	—
`2.1.1.29`	affected	—
`2.1.1.31`	affected	—
`2.1.1.33`	affected	—
`2.2.1.34`	affected	—
`2.2.1.35`	affected	—
`2.2.1.39`	affected	—
`2.2.1.41`	affected	—
`2.3.1.41`	affected	—
`2.3.1.45`	affected	—
`2.3.1.49`	affected	—
`2.3.1.50`	affected	—
`2.3.1.51`	affected	—
`2.3.1.52`	affected	—
`2.3.1.53`	affected	—
`3.1.1.53`	affected	—
`3.1.1.54`	affected	—
`3.1.1.55`	affected	—
`3.1.1.59`	affected	—
`3.1.1.61`	affected	—
`3.1.1.65`	affected	—
`3.1.1.67`	affected	—
`3.1.1.70`	affected	—
`3.2.1.18`	affected	—
`3.2.1.19`	affected	—
`3.2.1.20`	affected	—
`3.2.1.28`	affected	—
`3.2.1.31`	affected	—
`3.2.1.32`	affected	—
`3.2.1.33`	affected	—
`3.3.2.12`	affected	—
`3.3.2.16`	affected	—
`3.3.2.2`	affected	—
`3.3.2.23`	affected	—
`3.3.2.28`	affected	—
`3.3.2.33`	affected	—
`3.3.2.35`	affected	—
`3.3.2.42`	affected	—
`3.3.2.5`	affected	—
`3.3.2.50`	affected	—
`3.3.2.53`	affected	—
`3.4.1.1`	affected	—
`3.4.1.14`	affected	—
`3.4.1.19`	affected	—
`3.4.1.20`	affected	—
`3.4.1.28`	affected	—
`3.4.1.34`	affected	—
`3.4.1.35`	affected	—
`3.4.1.6`	affected	—
`3.4.1.40`	affected	—
`3.5.1.1`	affected	—
`3.5.1.17`	affected	—
`3.5.1.2`	affected	—
`3.5.1.20`	affected	—
`3.5.1.23`	affected	—
`3.5.1.30`	affected	—
`3.5.1.31`	affected	—
`3.5.1.37`	affected	—
`3.6.1.17`	affected	—
`3.6.1.21`	affected	—
`3.6.1.36`	affected	—
`3.6.1.47`	affected	—
`3.6.1.5`	affected	—
`3.6.1.52`	affected	—
`3.7.1.22`	affected	—
`3.7.1.5`	affected	—

Configuration 1 [-]

cpe:2.3:a:cisco:secure_workload:*:*:*:*:*:*:*:*

No data.

No data available yet.

Remediation

No solution or workaround provided in the CVE record

Tracking

Advisories

Source	ID	Title
EUVD	EUVD-2023-24315	A vulnerability in the OpenAPI of Cisco Secure Workload could allow an authenticated, remote attacker with the privileges of a read-only user to execute operations that should require Administrator privileges. The attacker would need valid user credentials. This vulnerability is due to improper role-based access control (RBAC) of certain OpenAPI operations. An attacker could exploit this vulnerability by issuing a crafted OpenAPI function call with valid credentials. A successful exploit could allow the attacker to execute OpenAPI operations that are reserved for the Administrator user, including the creation and deletion of user labels.