CVE-2020-11659

Vulnerability

CA API Developer Portal versions 4.3.1 and earlier contain an access control flaw in user administration functionality. This allows a privileged user to perform actions that should be restricted to higher-level administrators. [1]

Exploitation

An attacker authenticated as a privileged user (e.g., with administrative role) can exploit this flaw by sending crafted requests to the portal's user administration endpoints. No additional privileges or user interaction are required beyond having a privileged account. [1]

Impact

Successful exploitation allows the privileged user to perform restricted user administration actions, such as modifying user roles or privileges, leading to privilege escalation or unauthorized data access. The vendor rates the impact as low severity. [1]

Mitigation

Broadcom released a fix for this vulnerability. Affected customers should apply the vendor-supplied update. Details are available in the advisory from April 14, 2020. [1]