Cisco Secure Workload Unauthorized API Access Vulnerability

A vulnerability exists in the access validation of internal REST APIs in Cisco Secure Workload. This issue could allow an unauthenticated, remote attacker to access site resources with the privileges of the Site Admin role. The vulnerability arises from inadequate validation and authentication when accessing REST API endpoints. An attacker could exploit this by sending a crafted API request to an affected endpoint, potentially allowing them to read sensitive information and make configuration changes across tenant boundaries, all while impersonating a Site Admin user.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive information and the ability to make configuration changes across different tenant boundaries, using the privileges of a Site Admin user.

Remediation

Cisco has released software updates to address this vulnerability. For on-premises deployments, users should upgrade to Cisco Secure Workload versions 3.10.8.3 or 4.0.3.17. Those using Cisco Secure Workload SaaS deployment do not need to take any action, as the vulnerability has already been addressed.