Cisco Smart Software Manager On-Prem Web Application HTTP Request access control

Summaryinfo

A vulnerability identified as critical has been detected in Cisco Smart Software Manager On-Prem. This affects an unknown function of the component Web Application. Performing a manipulation as part of HTTP Request results in access control. This vulnerability is cataloged as CVE-2020-3245. It is possible to initiate the attack remotely. There is no exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability classified as critical has been found in Cisco Smart Software Manager On-Prem (affected version not known). This affects some unknown functionality of the component Web Application. The manipulation as part of a HTTP Request leads to a access control vulnerability. CWE is classifying the issue as CWE-284. The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

A vulnerability in the web application of Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an unauthenticated, remote attacker to create arbitrary user accounts. The vulnerability is due to the lack of authorization controls in the web application. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to add user accounts to the configuration of an affected device. These accounts would not be administrator or operator accounts.

The weakness was shared 06/18/2020 as cisco-sa-on-prem-access-ctrl-f as confirmed advisory (Website). It is possible to read the advisory at tools.cisco.com. This vulnerability is uniquely identified as CVE-2020-3245 since 12/12/2019. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1068 according to MITRE ATT&CK.

Upgrading eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• Cisco

Name

• Smart Software Manager On-Prem

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion