Action not permitted
Modal body text goes here.
ghsa-wxwr-gxwh-c78c
Vulnerability from github
A vulnerability in the restricted security domain implementation of Cisco Application Policy Infrastructure Controller (APIC) could allow an authenticated, remote attacker to modify the behavior of default system policies, such as quality of service (QoS) policies, on an affected system. This vulnerability is due to improper access control when restricted security domains are used to implement multi-tenancy. An attacker with a valid user account associated with a restricted security domain could exploit this vulnerability. A successful exploit could allow the attacker to read, modify, or delete child policies created under default system policies, which are implicitly used by all tenants in the fabric, resulting in disruption of network traffic. Exploitation is not possible for policies under tenants that an attacker has no authorization to access.
{ "affected": [], "aliases": [ "CVE-2024-20279" ], "database_specific": { "cwe_ids": [ "CWE-284" ], "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-08-28T17:15:06Z", "severity": "MODERATE" }, "details": "A vulnerability in the restricted security domain implementation of Cisco Application Policy Infrastructure Controller (APIC) could allow an authenticated, remote attacker to modify the behavior of default system policies, such as quality of service (QoS) policies, on an affected system.\u0026nbsp;This vulnerability is due to improper access control when restricted security domains are used to implement multi-tenancy. An attacker with a valid user account associated with a restricted security domain could exploit this vulnerability. A successful exploit could allow the attacker to read, modify, or delete child policies created under default system policies, which are implicitly used by all tenants in the fabric, resulting in disruption of network traffic. Exploitation is not possible for policies under tenants that an attacker has no authorization to access.", "id": "GHSA-wxwr-gxwh-c78c", "modified": "2024-08-28T18:31:54Z", "published": "2024-08-28T18:31:54Z", "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-20279" }, { "type": "WEB", "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apic-cousmo-uBpBYGbq" } ], "schema_version": "1.4.0", "severity": [ { "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "type": "CVSS_V3" } ] }
cve-2024-20279
Vulnerability from cvelistv5
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-20279", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-08-28T17:54:46.155615Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-08-28T17:54:51.419Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unknown", "product": "Cisco Application Policy Infrastructure Controller (APIC)", "vendor": "Cisco", "versions": [ { "status": "affected", "version": "3.2(8d)" }, { "status": "affected", "version": "2.2(1o)" }, { "status": "affected", "version": "1.2(2h)" }, { "status": "affected", "version": "2.2(2i)" }, { "status": "affected", "version": "1.2(1k)" }, { "status": "affected", "version": "2.2(1k)" }, { "status": "affected", "version": "3.1(2m)" }, { "status": "affected", "version": "3.2(1m)" }, { "status": "affected", "version": "3.2(5e)" }, { "status": "affected", "version": "4.1(2m)" }, { "status": "affected", "version": "3.2(41d)" }, { "status": "affected", "version": "1.1(1o)" }, { "status": "affected", "version": "1.2(1m)" }, { "status": "affected", "version": "1.2(2j)" }, { "status": "affected", "version": "2.2(4r)" }, { "status": "affected", "version": "2.2(3j)" }, { "status": "affected", "version": "1.1(3f)" }, { "status": "affected", "version": "2.2(2f)" }, { "status": "affected", "version": "1.1(4m)" }, { "status": "affected", "version": "2.2(2k)" }, { "status": "affected", "version": "2.1(1i)" }, { "status": "affected", "version": "2.0(1p)" }, { "status": "affected", "version": "3.1(2p)" }, { "status": "affected", "version": "3.2(3s)" }, { "status": "affected", "version": "4.0(3c)" }, { "status": "affected", "version": "1.1(4e)" }, { "status": "affected", "version": "4.1(1k)" }, { "status": "affected", "version": "2.2(4f)" }, { "status": "affected", "version": "2.1(3h)" }, { "status": "affected", "version": "3.2(4d)" }, { "status": "affected", "version": "2.0(1n)" }, { "status": "affected", "version": "2.0(1m)" }, { "status": "affected", "version": "2.0(1r)" }, { "status": "affected", "version": "2.1(2e)" }, { "status": "affected", "version": "4.2(2e)" }, { "status": "affected", "version": "4.2(3j)" }, { "status": "affected", "version": "4.2(3n)" }, { "status": "affected", "version": "2.0(1l)" }, { "status": "affected", "version": "2.2(2e)" }, { "status": "affected", "version": "2.2(3r)" }, { "status": "affected", "version": "3.0(2k)" }, { "status": "affected", "version": "2.1(3g)" }, { "status": "affected", "version": "4.0(1h)" }, { "status": "affected", "version": "2.0(1o)" }, { "status": "affected", "version": "2.2(3p)" }, { "status": "affected", "version": "1.2(3e)" }, { "status": "affected", "version": "2.2(3s)" }, { "status": "affected", "version": "2.0(2g)" }, { "status": "affected", "version": "4.1(1l)" }, { "status": "affected", "version": "3.2(9f)" }, { "status": "affected", "version": "4.2(3l)" }, { "status": "affected", "version": "4.2(2g)" }, { "status": "affected", "version": "1.2(3c)" }, { "status": "affected", "version": "3.2(7k)" }, { "status": "affected", "version": "1.3(2h)" }, { "status": "affected", "version": "3.2(9b)" }, { "status": "affected", "version": "1.3(2k)" }, { "status": "affected", "version": "3.1(2t)" }, { "status": "affected", "version": "1.1(2h)" }, { "status": "affected", "version": "3.2(3j)" }, { "status": "affected", "version": "2.1(2k)" }, { "status": "affected", "version": "2.3(1f)" }, { "status": "affected", "version": "1.2(3h)" }, { "status": "affected", "version": "3.0(1i)" }, { "status": "affected", "version": "4.1(2u)" }, { "status": "affected", "version": "4.2(1l)" }, { "status": "affected", "version": "4.1(1a)" }, { "status": "affected", "version": "4.0(3d)" }, { "status": "affected", "version": "1.1(4l)" }, { "status": "affected", "version": "2.3(1i)" }, { "status": "affected", "version": "3.1(2q)" }, { "status": "affected", "version": "3.2(4e)" }, { "status": "affected", "version": "4.1(1i)" }, { "status": "affected", "version": "3.1(1i)" }, { "status": "affected", "version": "2.0(2m)" }, { "status": "affected", "version": "3.0(2h)" }, { "status": "affected", "version": "2.2(2q)" }, { "status": "affected", "version": "2.3(1l)" }, { "status": "affected", "version": "1.3(1h)" }, { "status": "affected", "version": "3.0(2n)" }, { "status": "affected", "version": "3.2(5f)" }, { "status": "affected", "version": "1.2(1h)" }, { "status": "affected", "version": "3.2(1l)" }, { "status": "affected", "version": "4.2(1i)" }, { "status": "affected", "version": "4.1(2o)" }, { "status": "affected", "version": "1.2(1i)" }, { "status": "affected", "version": "1.3(1j)" }, { "status": "affected", "version": "2.1(1h)" }, { "status": "affected", "version": "2.0(2l)" }, { "status": "affected", "version": "2.0(2h)" }, { "status": "affected", "version": "1.2(2g)" }, { "status": "affected", "version": "3.0(1k)" }, { "status": "affected", "version": "4.2(1g)" }, { "status": "affected", "version": "2.1(2g)" }, { "status": "affected", "version": "2.0(1q)" }, { "status": "affected", "version": "1.1(1j)" }, { "status": "affected", "version": "4.1(2g)" }, { "status": "affected", "version": "1.1(1r)" }, { "status": "affected", "version": "4.2(2f)" }, { "status": "affected", "version": "3.2(6i)" }, { "status": "affected", "version": "1.3(1g)" }, { "status": "affected", "version": "1.3(2j)" }, { "status": "affected", "version": "1.3(2i)" }, { "status": "affected", "version": "2.0(2o)" }, { "status": "affected", "version": "2.2(4q)" }, { "status": "affected", "version": "2.3(1o)" }, { "status": "affected", "version": "3.2(3i)" }, { "status": "affected", "version": "2.2(2j)" }, { "status": "affected", "version": "1.1(1d)" }, { "status": "affected", "version": "2.0(2n)" }, { "status": "affected", "version": "2.2(3t)" }, { "status": "affected", "version": "3.2(3n)" }, { "status": "affected", "version": "1.1(4g)" }, { "status": "affected", "version": "4.1(2x)" }, { "status": "affected", "version": "3.2(5d)" }, { "status": "affected", "version": "3.1(2o)" }, { "status": "affected", "version": "1.2(2i)" }, { "status": "affected", "version": "2.1(2f)" }, { "status": "affected", "version": "1.3(2f)" }, { "status": "affected", "version": "4.2(3q)" }, { "status": "affected", "version": "4.1(1j)" }, { "status": "affected", "version": "2.0(2f)" }, { "status": "affected", "version": "2.3(1e)" }, { "status": "affected", "version": "1.1(1s)" }, { "status": "affected", "version": "3.1(2v)" }, { "status": "affected", "version": "4.1(2w)" }, { "status": "affected", "version": "1.1(4i)" }, { "status": "affected", "version": "3.1(2u)" }, { "status": "affected", "version": "1.1(4f)" }, { "status": "affected", "version": "3.0(2m)" }, { "status": "affected", "version": "2.0(1k)" }, { "status": "affected", "version": "3.2(2o)" }, { "status": "affected", "version": "3.2(3r)" }, { "status": "affected", "version": "1.1(2i)" }, { "status": "affected", "version": "4.0(2c)" }, { "status": "affected", "version": "1.3(1i)" }, { "status": "affected", "version": "4.1(2s)" }, { "status": "affected", "version": "3.2(7f)" }, { "status": "affected", "version": "1.2(3m)" }, { "status": "affected", "version": "3.2(3o)" }, { "status": "affected", "version": "3.1(2s)" }, { "status": "affected", "version": "3.2(2l)" }, { "status": "affected", "version": "4.2(1j)" }, { "status": "affected", "version": "2.3(1p)" }, { "status": "affected", "version": "2.1(4a)" }, { "status": "affected", "version": "1.1(1n)" }, { "status": "affected", "version": "2.2(1n)" }, { "status": "affected", "version": "2.2(4p)" }, { "status": "affected", "version": "2.1(3j)" }, { "status": "affected", "version": "4.2(4i)" }, { "status": "affected", "version": "3.2(9h)" }, { "status": "affected", "version": "5.0(1k)" }, { "status": "affected", "version": "4.2(4k)" }, { "status": "affected", "version": "5.0(1l)" }, { "status": "affected", "version": "5.0(2e)" }, { "status": "affected", "version": "4.2(4o)" }, { "status": "affected", "version": "4.2(4p)" }, { "status": "affected", "version": "5.0(2h)" }, { "status": "affected", "version": "4.2(5k)" }, { "status": "affected", "version": "4.2(5l)" }, { "status": "affected", "version": "4.2(5n)" }, { "status": "affected", "version": "5.1(1h)" }, { "status": "affected", "version": "4.2(6d)" }, { "status": "affected", "version": "5.1(2e)" }, { "status": "affected", "version": "4.2(6g)" }, { "status": "affected", "version": "4.2(6h)" }, { "status": "affected", "version": "5.1(3e)" }, { "status": "affected", "version": "3.2(10e)" }, { "status": "affected", "version": "4.2(6l)" }, { "status": "affected", "version": "4.2(7f)" }, { "status": "affected", "version": "5.1(4c)" }, { "status": "affected", "version": "4.2(6o)" }, { "status": "affected", "version": "5.2(1g)" }, { "status": "affected", "version": "5.2(2e)" }, { "status": "affected", "version": "4.2(7l)" }, { "status": "affected", "version": "3.2(10f)" }, { "status": "affected", "version": "5.2(2f)" }, { "status": "affected", "version": "5.2(2g)" }, { "status": "affected", "version": "4.2(7q)" }, { "status": "affected", "version": "5.2(2h)" }, { "status": "affected", "version": "5.2(3f)" }, { "status": "affected", "version": "5.2(3e)" }, { "status": "affected", "version": "5.2(3g)" }, { "status": "affected", "version": "4.2(7r)" }, { "status": "affected", "version": "4.2(7s)" }, { "status": "affected", "version": "5.2(4d)" }, { "status": "affected", "version": "5.2(4e)" }, { "status": "affected", "version": "4.2(7t)" }, { "status": "affected", "version": "5.2(5d)" }, { "status": "affected", "version": "3.2(10g)" }, { "status": "affected", "version": "5.2(5c)" }, { "status": "affected", "version": "6.0(1g)" }, { "status": "affected", "version": "4.2(7u)" }, { "status": "affected", "version": "5.2(5e)" }, { "status": "affected", "version": "5.2(4f)" }, { "status": "affected", "version": "5.2(6e)" }, { "status": "affected", "version": "6.0(1j)" }, { "status": "affected", "version": "5.2(6g)" }, { "status": "affected", "version": "5.2(7f)" }, { "status": "affected", "version": "4.2(7v)" }, { "status": "affected", "version": "5.2(7g)" }, { "status": "affected", "version": "6.0(2h)" }, { "status": "affected", "version": "4.2(7w)" }, { "status": "affected", "version": "5.2(6h)" }, { "status": "affected", "version": "5.2(4h)" }, { "status": "affected", "version": "5.2(8d)" }, { "status": "affected", "version": "6.0(2j)" }, { "status": "affected", "version": "5.2(8e)" }, { "status": "affected", "version": "6.0(3d)" }, { "status": "affected", "version": "6.0(3e)" }, { "status": "affected", "version": "5.2(8f)" }, { "status": "affected", "version": "5.2(8g)" }, { "status": "affected", "version": "5.3(1d)" }, { "status": "affected", "version": "5.2(8h)" }, { "status": "affected", "version": "6.0(4c)" }, { "status": "affected", "version": "5.3(2a)" }, { "status": "affected", "version": "5.2(8i)" }, { "status": "affected", "version": "6.0(5h)" }, { "status": "affected", "version": "5.3(2b)" }, { "status": "affected", "version": "6.0(3g)" }, { "status": "affected", "version": "6.0(5j)" } ] } ], "descriptions": [ { "lang": "en", "value": "A vulnerability in the restricted security domain implementation of Cisco Application Policy Infrastructure Controller (APIC) could allow an authenticated, remote attacker to modify the behavior of default system policies, such as quality of service (QoS) policies, on an affected system.\u0026nbsp;This vulnerability is due to improper access control when restricted security domains are used to implement multi-tenancy. An attacker with a valid user account associated with a restricted security domain could exploit this vulnerability. A successful exploit could allow the attacker to read, modify, or delete child policies created under default system policies, which are implicitly used by all tenants in the fabric, resulting in disruption of network traffic. Exploitation is not possible for policies under tenants that an attacker has no authorization to access." } ], "exploits": [ { "lang": "en", "value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory." } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1" }, "format": "cvssV3_1" } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-284", "description": "Improper Access Control", "lang": "en", "type": "cwe" } ] } ], "providerMetadata": { "dateUpdated": "2024-08-28T16:19:08.343Z", "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "shortName": "cisco" }, "references": [ { "name": "cisco-sa-apic-cousmo-uBpBYGbq", "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apic-cousmo-uBpBYGbq" } ], "source": { "advisory": "cisco-sa-apic-cousmo-uBpBYGbq", "defects": [ "CSCwe67288" ], "discovery": "INTERNAL" }, "title": "Cisco Application Policy Infrastructure Controller Unauthorized Policy Actions Vulnerability" } }, "cveMetadata": { "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "assignerShortName": "cisco", "cveId": "CVE-2024-20279", "datePublished": "2024-08-28T16:19:08.343Z", "dateReserved": "2023-11-08T15:08:07.625Z", "dateUpdated": "2024-08-28T17:54:51.419Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.