Access Control Flaw in Cisco APIC Affecting Multi-Tenant Policies

CVE-2023-20230

Summary

A vulnerability in the implementation of restricted security domains in Cisco's Application Policy Infrastructure Controller (APIC) could permit an authenticated remote attacker to read, modify, or delete non-tenant policies. This issue arises from improper access control measures allowing access to security domain policies beyond tenant boundaries. An attacker with a valid user account within a restricted security domain can exploit this vulnerability, leading to unauthorized manipulation of policies associated with other security domains. It is essential to note that policies under tenants that the attacker is not authorized to access remain protected against exploitation.

References