{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"state":"PUBLISHED","cveId":"CVE-2023-20136","assignerOrgId":"d1c1063e-7a18-46af-9102-31f8928bc633","assignerShortName":"cisco","dateUpdated":"2024-08-02T08:57:36.064Z","dateReserved":"2022-10-27T00:00:00.000Z","datePublished":"2023-06-28T00:00:00.000Z"},"containers":{"cna":{"providerMetadata":{"orgId":"d1c1063e-7a18-46af-9102-31f8928bc633","shortName":"cisco","dateUpdated":"2024-01-25T16:57:48.042Z"},"descriptions":[{"lang":"en","value":"A vulnerability in the OpenAPI of Cisco Secure Workload could allow an authenticated, remote attacker with the privileges of a read-only user to execute operations that should require Administrator privileges. The attacker would need valid user credentials.\r\n\r This vulnerability is due to improper role-based access control (RBAC) of certain OpenAPI operations. An attacker could exploit this vulnerability by issuing a crafted OpenAPI function call with valid credentials. A successful exploit could allow the attacker to execute OpenAPI operations that are reserved for the Administrator user, including the creation and deletion of user labels."}],"affected":[{"vendor":"Cisco","product":"Cisco Secure Workload","versions":[{"version":"1.102.21","status":"affected"},{"version":"1.103.1.12","status":"affected"},{"version":"2.0.1.34","status":"affected"},{"version":"2.0.2.20","status":"affected"},{"version":"2.1.1.29","status":"affected"},{"version":"2.1.1.31","status":"affected"},{"version":"2.1.1.33","status":"affected"},{"version":"2.2.1.34","status":"affected"},{"version":"2.2.1.35","status":"affected"},{"version":"2.2.1.39","status":"affected"},{"version":"2.2.1.41","status":"affected"},{"version":"2.3.1.41","status":"affected"},{"version":"2.3.1.45","status":"affected"},{"version":"2.3.1.49","status":"affected"},{"version":"2.3.1.50","status":"affected"},{"version":"2.3.1.51","status":"affected"},{"version":"2.3.1.52","status":"affected"},{"version":"2.3.1.53","status":"affected"},{"version":"3.1.1.53","status":"affected"},{"version":"3.1.1.54","status":"affected"},{"version":"3.1.1.55","status":"affected"},{"version":"3.1.1.59","status":"affected"},{"version":"3.1.1.61","status":"affected"},{"version":"3.1.1.65","status":"affected"},{"version":"3.1.1.67","status":"affected"},{"version":"3.1.1.70","status":"affected"},{"version":"3.2.1.18","status":"affected"},{"version":"3.2.1.19","status":"affected"},{"version":"3.2.1.20","status":"affected"},{"version":"3.2.1.28","status":"affected"},{"version":"3.2.1.31","status":"affected"},{"version":"3.2.1.32","status":"affected"},{"version":"3.2.1.33","status":"affected"},{"version":"3.3.2.12","status":"affected"},{"version":"3.3.2.16","status":"affected"},{"version":"3.3.2.2","status":"affected"},{"version":"3.3.2.23","status":"affected"},{"version":"3.3.2.28","status":"affected"},{"version":"3.3.2.33","status":"affected"},{"version":"3.3.2.35","status":"affected"},{"version":"3.3.2.42","status":"affected"},{"version":"3.3.2.5","status":"affected"},{"version":"3.3.2.50","status":"affected"},{"version":"3.3.2.53","status":"affected"},{"version":"3.4.1.1","status":"affected"},{"version":"3.4.1.14","status":"affected"},{"version":"3.4.1.19","status":"affected"},{"version":"3.4.1.20","status":"affected"},{"version":"3.4.1.28","status":"affected"},{"version":"3.4.1.34","status":"affected"},{"version":"3.4.1.35","status":"affected"},{"version":"3.4.1.6","status":"affected"},{"version":"3.4.1.40","status":"affected"},{"version":"3.5.1.1","status":"affected"},{"version":"3.5.1.17","status":"affected"},{"version":"3.5.1.2","status":"affected"},{"version":"3.5.1.20","status":"affected"},{"version":"3.5.1.23","status":"affected"},{"version":"3.5.1.30","status":"affected"},{"version":"3.5.1.31","status":"affected"},{"version":"3.5.1.37","status":"affected"},{"version":"3.6.1.17","status":"affected"},{"version":"3.6.1.21","status":"affected"},{"version":"3.6.1.36","status":"affected"},{"version":"3.6.1.47","status":"affected"},{"version":"3.6.1.5","status":"affected"},{"version":"3.6.1.52","status":"affected"},{"version":"3.7.1.22","status":"affected"},{"version":"3.7.1.5","status":"affected"}]}],"problemTypes":[{"descriptions":[{"lang":"en","description":"Incorrect Use of Privileged APIs","type":"cwe","cweId":"CWE-648"}]}],"references":[{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-csw-auth-openapi-kTndjdNX","name":"cisco-sa-csw-auth-openapi-kTndjdNX"}],"metrics":[{"format":"cvssV3_1","cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"}}],"exploits":[{"lang":"en","value":"The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."}],"source":{"advisory":"cisco-sa-csw-auth-openapi-kTndjdNX","discovery":"INTERNAL","defects":["CSCwe74218"]}},"adp":[{"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-02T08:57:36.064Z"},"title":"CVE Program Container","references":[{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-csw-auth-openapi-kTndjdNX","name":"cisco-sa-csw-auth-openapi-kTndjdNX","tags":["x_transferred"]}]}]}}