Quantum Secular Labs / Blog / Advisories

CVE-2018-0435: Cisco Umbrella: Improper Authentication

CVE-2018-0435 is rated critical with a CVSS v3.0 base score of 9.1 and affects Cisco Umbrella. Per its scoring, it can be exploited over the network, without any user interaction.

Vulnerability description

A vulnerability in the Cisco Umbrella API could allow an authenticated, remote attacker to view and modify data across their organization and other organizations. The vulnerability is due to insufficient authentication configurations for the API interface of Cisco Umbrella. An attacker could exploit this vulnerability to view and potentially modify data for their organization or other organizations. A successful exploit could allow the attacker to read or modify data across multiple organizations.

Severity breakdown

CVSS v3.0 9.1: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H

  • Attack vector: Network. Exploitable remotely over the network, with no need for local or physical access.
  • Attack complexity: Low. No special conditions; the attack can be repeated reliably.
  • Privileges required: Low. A basic user account is enough.
  • User interaction: None. No action from any user is needed.
  • Scope: Changed. Impact reaches beyond the vulnerable component to other resources.
  • Confidentiality impact: Low. Some information is exposed.
  • Integrity impact: Low. Some data can be modified.
  • Availability impact: High. Total loss of availability; the component can be shut down.

Underlying weakness

CWE-287: Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Affected products

  • Cisco Umbrella: all versions listed by NVD

References