cisco-sa-20180718-policy-suite-change: Cisco Policy Suite Read-Only User Effect Change Vulnerability
First published: Wed Jul 18 2018(Updated: )
A vulnerability in the Policy Builder interface of Cisco Policy Suite could allow an authenticated, remote attacker to make policy changes in the Policy Builder interface. The vulnerability is due to insufficient authorization controls. An attacker could exploit this vulnerability by accessing the Policy Builder interface and modifying an HTTP request. A successful exploit could allow the attacker to make changes to existing policies. There are no workarounds that address this vulnerability. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180718-policy-suite-change
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco Policy Suite Software |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of cisco-sa-20180718-policy-suite-change?
The severity of cisco-sa-20180718-policy-suite-change is considered high due to the potential for unauthorized policy changes.
How do I fix cisco-sa-20180718-policy-suite-change?
To fix cisco-sa-20180718-policy-suite-change, apply the latest security patches provided by Cisco for Policy Suite.
Who is affected by cisco-sa-20180718-policy-suite-change?
The vulnerability in cisco-sa-20180718-policy-suite-change affects all versions of Cisco Policy Suite that are not updated.
What type of attacks are possible with cisco-sa-20180718-policy-suite-change?
An attacker can exploit cisco-sa-20180718-policy-suite-change to make unauthorized changes to policies in the Policy Builder interface.
Is authentication required to exploit cisco-sa-20180718-policy-suite-change?
Yes, cisco-sa-20180718-policy-suite-change requires an authenticated user to exploit the vulnerability.
- agent/type
- agent/event
- agent/last-modified-date
- agent/first-publish-date
- collector/cisco-advisory
- source/Cisco
- agent/weakness
- agent/title
- agent/severity
- agent/references
- agent/description
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/cisco
- canonical/cisco policy suite software