CVE-2023-20230

A vulnerability in the restricted security domain implementation of Cisco Application Policy Infrastructure Controller (APIC) could allow an authenticated, remote attacker to read, modify, or delete non-tenant policies (for example, access policies) created by users associated with a different security domain on an affected system. This vulnerability is due to improper access control when restricted security domains are used to implement multi-tenancy for policies outside the tenant boundaries. An attacker with a valid user account associated with a restricted security domain could exploit this vulnerability. A successful exploit could allow the attacker to read, modify, or delete policies created by users associated with a different security domain. Exploitation is not possible for policies under tenants that an attacker has no authorization to access.
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:cisco:application_policy_infrastructure_controller:*:*:*:*:*:*:*:*
cpe:2.3:a:cisco:application_policy_infrastructure_controller:*:*:*:*:*:*:*:*

History

25 Jan 2024, 17:15

Type Values Removed Values Added
New CVE

Information

Published : 2023-08-23 19:15

Updated : 2024-02-05 00:01


NVD link : CVE-2023-20230

Mitre link : CVE-2023-20230

CVE.ORG link : CVE-2023-20230


JSON object : View

Products Affected

cisco

  • application_policy_infrastructure_controller
CWE
CWE-732

Incorrect Permission Assignment for Critical Resource

CWE-284

Improper Access Control