Cisco Talos Intelligence For Enterprise Security Cloud
Monthly
Unauthenticated exposure of the OpenAPI specification in Cisco Talos Intelligence for Enterprise Security Cloud (versions below 1.0.3) allows any network-accessible user to retrieve the add-on's full REST API documentation via Splunk Web static file paths. The disclosed specification reveals API endpoint structure and the authentication model, enabling reconnaissance that could facilitate targeted follow-on attacks. No active exploitation or public exploit code has been identified at time of analysis.
Server-Side Request Forgery (SSRF) in Cisco Talos Intelligence for Enterprise Security Cloud (versions below 1.0.3) allows an authenticated Splunk user holding the get_talos_enrichment capability to redirect the instance's outbound authenticated management requests to an attacker-controlled server, exposing Splunk management tokens. Successful exploitation grants the attacker full control over the Splunk instance, compromising the confidentiality, integrity, and availability of all data and configurations within it. No public exploit code or CISA KEV listing has been identified at time of analysis, but the patch is available and the CVSS score of 8.8 reflects the severity of token theft as a post-exploitation path.
Unauthenticated exposure of the OpenAPI specification in Cisco Talos Intelligence for Enterprise Security Cloud (versions below 1.0.3) allows any network-accessible user to retrieve the add-on's full REST API documentation via Splunk Web static file paths. The disclosed specification reveals API endpoint structure and the authentication model, enabling reconnaissance that could facilitate targeted follow-on attacks. No active exploitation or public exploit code has been identified at time of analysis.
Server-Side Request Forgery (SSRF) in Cisco Talos Intelligence for Enterprise Security Cloud (versions below 1.0.3) allows an authenticated Splunk user holding the get_talos_enrichment capability to redirect the instance's outbound authenticated management requests to an attacker-controlled server, exposing Splunk management tokens. Successful exploitation grants the attacker full control over the Splunk instance, compromising the confidentiality, integrity, and availability of all data and configurations within it. No public exploit code or CISA KEV listing has been identified at time of analysis, but the patch is available and the CVSS score of 8.8 reflects the severity of token theft as a post-exploitation path.