Cisco IOS XE Web UI HTTP Request authorization

Summaryinfo

A vulnerability marked as critical has been reported in Cisco IOS XE. Affected by this vulnerability is an unknown functionality of the component Web UI. Performing a manipulation as part of HTTP Request results in authorization. This vulnerability is known as CVE-2020-3400. Remote exploitation of the attack is possible. No exploit is available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability classified as critical has been found in Cisco IOS XE (Router Operating System) (the affected version is unknown). This affects an unknown code of the component Web UI. The manipulation as part of a HTTP Request leads to a authorization vulnerability. CWE is classifying the issue as CWE-862. The product does not perform an authorization check when an actor attempts to access a resource or perform an action. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

A vulnerability in the web UI feature of Cisco IOS XE Software could allow an authenticated, remote attacker to utilize parts of the web UI for which they are not authorized.The vulnerability is due to insufficient authorization of web UI access requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to the web UI. A successful exploit could allow the attacker to utilize parts of the web UI for which they are not authorized. This could allow a Read-Only user to perform actions of an Admin user.

The weakness was published 09/24/2020 as cisco-sa-webui-auth-bypass-6j2 as confirmed advisory (Website). The advisory is shared at tools.cisco.com. This vulnerability is uniquely identified as CVE-2020-3400 since 12/12/2019. It is possible to initiate the attack remotely. A authentication is needed for exploitation. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 09/25/2020).

Upgrading eliminates this vulnerability.

Similar entries are available at VDB-161868, VDB-161867, VDB-161866 and VDB-161864. Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Router Operating System

Vendor

• Cisco

Name

• IOS XE

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion