Its a day 0 code issue in both UI(Reporting) and APIs for paths and virtual paths when we fetch all attributes and the selected time interval is greater than 1 hour.
There are 3 attributes which have a problem –wan_to_lan_best_one_way_time_max_latency_ms, wan_to_lan_best_one_way_time_min_latency_ms, wan_to_lan_min_jitter_ms
To work around the issue the api should use the attribute filter (where we specify a comma separated list of attributes) and ensure to exclude the above 3 attributes as shown in the below workaround.
curl -X GET -b cookies.txt “https:// /sdwan_center/nitro/v1/reports/virtual_paths?page=size:650;number:1&filter=last_by:day&attrs=lan_to_wan_bandwidth,wan_to_lan_bandwidth,percent_up_time” -v
Issue is fixed in 11.4.1 . Upgrade to 11.4.1 to fix the issue.
A vulnerability in the change password API of Cisco Connected Mobile Experiences (CMX) could allow an authenticated, remote attacker to alter their own password to a value that does not comply with the strong authentication requirements that are configured on an affected device.
This vulnerability exists because a password policy check is incomplete at the time a password is changed at server side using the API. An attacker could exploit this vulnerability by sending a specially crafted API request to the affected device. A successful exploit could allow the attacker to change their own password to a value that does not comply with the configured strong authentication requirements.
Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
This advisory is available at the following link:
Security Impact Rating: Medium
” Failed to login the user due to insufficient claims. Please contact your administrator”
The Attributes sent by Citrix Access Gateway (OAuth IDP) can be seen in /var/log/ns.log.
In the below log snippet, you could see that the Attributes such as ( Name, UPN, CIP and SID, etc ) sent by Citrix Access GAteway (OAuth IDP) are BLANK.
Nov 6 13:55:09 <local0.info> XX.XX.XX.XX 06/11/2019:12:55:09 0-PPE-0 : default AAATM Message 3795 0 : “OAUTHIDP: CC IDTOKEN: user: <firstname.lastname@example.org>’s claims are: sub:, name:, upn:, email:, ctx_auth_alias:, cip_domain:, cip_forest: sid:, oid:, amr:[“otp”], nonce:637085983001757588.Mjg2NWQ2YWMtZDI5OC00ZjQ4LTk0NDQtNTJlM2I1ZmVlNjBlOGQ0NzQ0OWUtNjZlMi00NjI0LWIzMWQtNTNjYzMzY2VkYzk0, familyname:, givename:, domain: , groups len 0