CVE-2020-11661

Vulnerability

CA API Developer Portal versions 4.3.1 and earlier contain an access control flaw that allows a privileged user to view and edit user data [1]. The vulnerability is due to insufficient authorization checks on certain administrative functions.

Exploitation

An attacker must already have a privileged account (e.g., administrator) on the portal. No additional authentication bypass is needed; the flaw lies in the lack of proper access controls for viewing and editing user data. The attacker can directly access the affected functionality.

Impact

A privileged user can view sensitive user data and modify user profiles, potentially leading to unauthorized changes to user accounts or disclosure of personal information. The risk rating is Low [1].

Mitigation

Broadcom has released a fix; customers should apply the latest security update as indicated in the advisory [1]. No workaround is mentioned. The fix addresses the access control flaw.