CyberRota Analysis
AI-GeneratedCisco Talos Intelligence for Enterprise Security Cloud versions prior to 1.0.3 are vulnerable due to an unauthenticated access issue that exposes the OpenAPI specification via static file paths in Splunk Web. This exposure allows attackers to perform reconnaissance on REST API endpoints and the authentication model, potentially leading to further exploitation. Organizations using affected versions should prioritize this vulnerability to mitigate risks associated with unauthorized access and potential data breaches.
Original NVD Description
In Cisco Talos Intelligence for Enterprise Security Cloud versions below 1.0.3, an unauthenticated user could access the add-on OpenAPI specification through Splunk Web static file paths. The exposed specification could allow for reconnaissance of the add-on Representational State Transfer (REST) API endpoints and authentication model. The vulnerability is possible because the generated OpenAPI specification is packaged in a static file path that Splunk Web serves without authentication. For more information see Deploy Cisco Talos Intelligence for Splunk Enterprise Security (https://help.splunk.com/en/splunk-enterprise-security-8/user-guide/8.0/introduction/deploy-cisco-talos-intelligence-for-splunk-enterprise-security-cloud-only) in the Splunk documentation.
Related CVEs
Other vulnerabilities affecting the same vendor(s)