CVE-2018-0435 Cisco Umbrella API Unauthorized Access Vulnerability

What is CVE-2018-0435?

CVE-2018-0435 is a critical missing authorization vulnerability in Cisco Umbrella, published on 5 Oct 2018. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

A vulnerability in the Cisco Umbrella API could allow an authenticated, remote attacker to view and modify data across their organization and other organizations. The vulnerability is due to insufficient authentication configurations for the API interface of Cisco Umbrella. An attacker could exploit this vulnerability to view and potentially modify data for their organization or other organizations. A successful exploit could allow the attacker to read or modify data across multiple organizations.

Weakness: CWE-287

Which versions are affected by CVE-2018-0435?

It affects 1 product.

Products include Cisco Umbrella.

How do I fix CVE-2018-0435?

No fix has been published for CVE-2018-0435 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2018-0435 being exploited?

There is no known exploitation of CVE-2018-0435 in the wild and no public exploit code.

Other vulnerabilities in Cisco Umbrella

• CVE-2019-1807 Cisco Umbrella Dashboard Session Management Vulnerability High 7.6
• CVE-2021-1474 Cisco Umbrella Link and CSV Formula Injection Vulnerabilities Medium 6.5
• CVE-2021-1475 Cisco Umbrella Link and CSV Formula Injection Vulnerabilities Medium 6.5
• CVE-2019-1792 Cisco Umbrella Cross-Site Scripting Vulnerability Medium 6.1
• CVE-2021-1350 Cisco Umbrella Dashboard Packet Flood Vulnerability Medium 5.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-6frj-jhq2-gcfc.