Lucene search

[email protected]CVE-2022-20956

HistoryNov 04, 2022 - 6:15 p.m.

CVE-2022-20956

2022-11-0418:15:11

CWE-648

[email protected]

web.nvd.nist.gov

cisco

ise

web-based management interface

vulnerability

cve-2022-20956

access control

security advisory

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

8.5 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

54.7%

JSON

A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to bypass authorization and access system files.

This vulnerability is due to improper access control in the web-based management interface of an affected device. An attacker could exploit this vulnerability by sending a crafted HTTP request to the affected device. A successful exploit could allow the attacker to list, download, and delete certain files that they should not have access to.

Cisco plans to release software updates that address this vulnerability.

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-access-contol-EeufSUCx [“https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-access-contol-EeufSUCx”]

Affected configurations

NVD

Node

ciscoidentity_services_engineMatch3.1-

ciscoidentity_services_engineMatch3.1patch1

ciscoidentity_services_engineMatch3.1patch3

ciscoidentity_services_engineMatch3.1patch4

ciscoidentity_services_engineMatch3.2-

CPENameOperatorVersion
cisco:identity_services_enginecisco identity services engineeq3.1
cisco:identity_services_enginecisco identity services engineeq3.2

CPE	Name	Operator	Version
cisco:identity_services_engine	cisco identity services engine	eq	3.1
cisco:identity_services_engine	cisco identity services engine	eq	3.2

CNA Affected

[
  {
    "vendor": "Cisco",
    "product": "Cisco Identity Services Engine Software",
    "versions": [
      {
        "version": "3.1.0",
        "status": "affected"
      },
      {
        "version": "3.1.0 p1",
        "status": "affected"
      },
      {
        "version": "3.1.0 p3",
        "status": "affected"
      },
      {
        "version": "3.1.0 p4",
        "status": "affected"
      },
      {
        "version": "3.2.0",
        "status": "affected"
      }
    ]
  }
]