The vulnerability allows attackers to access resources with 'Site Admin' role rights without prior authentication due to insufficient validation and authentication checks on internal REST APIs.
| Vendor | Product | Versions |
|---|---|---|
| cis | secure workload | 2.2.1.41, 3.2.1.18, 3.3.2.50, 3.4.1.28, 3.4.1.34, 2.3.1.45, 2.3.1.41, 3.3.2.28, 3.1.1.59, 2.0.2.20, 2.1.1.33, 2.1.1.29, 3.2.1.28, 3.4.1.35, 3.1.1.65, 3.1.1.67, 2.0.1.34, 2.3.1.49, 2.2.1.39, 3.4.1.19, 3.3.2.23, 3.1.1.61, 3.1.1.54, 3.5.1.17, 3.3.2.33, 3.5.1.1, 2.3.1.53, 3.5.1.20, 3.5.1.30, 3.3.2.16, 3.1.1.55, 3.4.1.6, 2.3.1.50, 2.3.1.52, 3.2.1.19, 2.2.1.35, 3.1.1.53, 3.1.1.70, 3.2.1.20, 3.5.1.2, 1.103.1.12, 2.3.1.51, 3.3.2.42, 3.4.1.1, 3.3.2.12, 2.1.1.31, 3.5.1.23, 3.3.2.53, 3.4.1.14, 3.3.2.2, 3.4.1.20, 3.3.2.35, 2.2.1.34, 1.102.21, 3.3.2.5, 3.5.1.31, 3.6.1.5, 3.2.1.31, 3.5.1.37, 3.4.1.40, 3.6.1.17, 3.6.1.21, 3.2.1.32, 3.2.1.33, 3.6.1.35, 3.6.1.36, 3.7.1.5, 3.6.1.47, 3.7.1.22, 3.6.1.52, 3.7.1.39, 3.8.1.1, 3.7.1.51, 3.8.1.19, 3.8.1.36, 3.7.1.59, 3.8.1.39, 3.9.1.1, 3.9.1.10, 3.9.1.24, 3.9.1.25, 3.9.1.28, 3.9.1.38, 3.8.1.53, 3.9.1.52, 3.10.1.1, 3.9.1.64, 3.10.2.11, 3.9.1.66, 3.10.3.19, 3.9.1.69, 3.10.4.8, 3.10.5.6, 4.0.1.1, 4.0.2.4, 4.0.2.5, 3.10.6.3, 3.10.7.4, 4.0.3.13, 3.10.8.3 |
Downstream vendors/products affected by this vulnerability
| Vendor | Product | Source | Confidence |
|---|---|---|---|
| cis | secure_workload | cert_advisory | 90% |
Updated affected versions to include 3.10.8.3, marked exploit as available, and noted that the vulnerability is actively exploited.
Updated description with technical details, added affected version 3.10.8.3, and marked exploit as available and actively exploited.
Updated vendor to Cisco, added description about insufficient validation and authentication, and marked exploit as available and actively exploited.
Updated vendor to Cisco, added affected version 3.10.8.3, marked exploit as available and actively exploited, and provided a more detailed description of the vulnerability.
Updated vendor to Cisco, added new affected version 3.10.8.3, and confirmed CVSS score of 10.0.
Initial creation
