CVE-2021-1143

Medium

Description

A vulnerability in Cisco Connected Mobile Experiences (CMX) API authorizations could allow an authenticated, remote attacker to enumerate what users exist on the system. The vulnerability is due to a lack of authorization checks for certain API GET requests. An attacker could exploit this vulnerability by sending specific API GET requests to an affected device. A successful exploit could allow the attacker to enumerate users of the CMX system.

SeverityMedium

CVSS4.3

Exploit probability—

Product

Cisco Connected Mobile Experiences

PublishedJan 13, 2021

First seenJan 13, 2021

Weakness typeCWE-863Incorrect authorization

How to fix

Vendor advisories

tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cmxapi-KsKwCmfp

Affected products

Product	Affected versions	Fixed in
cisco connected_mobile_experiences	10.6.0, 10.6.1, 10.6.2	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.