====================================================================


                             CERT-Renater

                 Note d'Information No. 2018/VULN272
_____________________________________________________________________

DATE                : 06/09/2018

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Cisco Umbrella API.

=====================================================================
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180905-umbrella-api
_____________________________________________________________________

Cisco Security Advisory: Cisco Umbrella API Unauthorized Access
Vulnerability

Advisory ID: cisco-sa-20180905-umbrella-api

Revision: 1.0

For Public Release: 2018 September 5 16:00 GMT

Last Updated: 2018 September 5 16:00 GMT

CVE ID(s): CVE-2018-0435

CVSS Score v(3): 9.1 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H

+---------------------------------------------------------------------

Summary

=======

A vulnerability in the Cisco Umbrella API could allow an authenticated,
remote attacker to view and modify data across their organization and
other organizations.

The vulnerability is due to insufficient authentication configurations
for the API interface of Cisco Umbrella. An attacker could exploit this
vulnerability to view and potentially modify data for their organization
or other organizations. A successful exploit could allow the attacker to
read or modify data across multiple organizations.

Cisco has released software updates that address this vulnerability.
There are no workarounds that address this vulnerability.

This advisory is available at the following link:

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180905-umbrella-api
["https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180905-umbrella-api"]


=========================================================
+ CERT-RENATER        | tel : 01-53-94-20-44            +
+ 23/25 Rue Daviel    | fax : 01-53-94-20-41            +
+ 75013 Paris         | email:cert@support.renater.fr   +
=========================================================