4.3
Medium
CVE-2023-20136 A vulnerability in the OpenAPI of Cisco Secure Workload could allow an authenticated, remote attacker with the…
Description
A vulnerability in the OpenAPI of Cisco Secure Workload could allow an authenticated, remote attacker with the privileges of a read-only user to execute operations that should require Administrator privileges. The attacker would need valid user credentials. This vulnerability is due to improper role-based access control (RBAC) of certain OpenAPI operations. An attacker could exploit this vulnerability by issuing a crafted OpenAPI function call with valid credentials. A successful exploit could allow the attacker to execute OpenAPI operations that are reserved for the Administrator user, including the creation and deletion of user labels.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Cisco Secure Workload 3.7 | 3.7.1.5 → 3.7.1.22 | No fix stated |
| Cisco Secure Workload 3.6 | 3.6.1.5 → 3.6.1.52 | No fix stated |
| Cisco Secure Workload 3.5 | 3.5.1.1 → 3.5.1.37 | No fix stated |
| Cisco Secure Workload 3.4 | 3.4.1.1 → 3.4.1.40 | No fix stated |
| Cisco Secure Workload 3.3 | 3.3.2.2 → 3.3.2.53 | No fix stated |
| Cisco Secure Workload 3.2 | 3.2.1.18 → 3.2.1.33 | No fix stated |
| Cisco Secure Workload 3.1 | 3.1.1.53 → 3.1.1.70 | No fix stated |
| Cisco Secure Workload 2.3 | 2.3.1.41 → 2.3.1.53 | No fix stated |
| Cisco Secure Workload 2.2 | 2.2.1.34 → 2.2.1.41 | No fix stated |
Show the 4 other branches Hide the 4 other branches
| Product | Affected versions | Fixed in |
|---|---|---|
| Cisco Secure Workload 2.1 | 2.1.1.29 → 2.1.1.33 | No fix stated |
| Cisco Secure Workload 2.0 | 2.0.1.34 → 2.0.2.20 | No fix stated |
| Cisco Secure Workload | 1.103.1.12 | No fix stated |
| Cisco Secure Workload | 1.102.21 | No fix stated |
References
- cisco-sa-csw-auth-openapi-kTndjdNX sec.cloudapps.cisco.com
Timeline
- Published
- Last modified
Other CVEs of Cisco Secure Workload
The 9 CVEs of Cisco Secure Workload →
CVE-2026-20319
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Workload engineering…
7.5
High
CVE-2026-20315
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Workload engineering…
10.0
Critical
CVE-2026-20317
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Workload engineering…
10.0
Critical
CVE-2026-20318
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Workload engineering…
9.6
Critical