Cisco Identity Services Engine (cisco-sa-ise-file-upload-P4M8vwXY)

#TRUSTED 0fca1da87e9dc2be40dd8a7f6c711a5d9fb7557c1d5aa3fe99ea3f5fb9279761cc7c41756099c82944c401dfadfc80d839e08366e2cc7e6f2e1db379b9279fcdf9592d811b5923a58550ba6d8cec158ee03fa9b60e5bf357ad19024c61273c75b17202c32d78b3275a74698ac23c6372900d45c0344e5dcf19bdd09dd8e7f24598d4a07b653ec0fe0fa3c7ec40cd7a70c97e74f2fc6d39d9351e8368cab10e722bd3a765f8d2d6520f34fea97869290274322f18b320a2b55c3583ba516b29553ea589f1b939055176f225cbce44705f28a0fb1d4698cf858137f0b42a9dfec98fd259689953710a4dce089bb56a5370477de44097ab2e9b49dee406310d968cca3cc6d425597bf94c591fff851f2ccca80b58502f1383987accd132388542e4bfcf6e06b26da32c0963b7a2e79f5e71140bc55113c5abeb75792c8b8dfb25edce5f11834e5112e38a5cca68e6d7cde5384bb1bce84d299fa6a882323d52559232c1189d3eb964183b2dadb21c42fe509ee1f205a031cb5f9e10b38b38b93ecaebe6083af42e0fa9970472933477374bbd2a0290d79d874b8f4597ef1033ad054cb0886b0826c80f4406544d8dffd9ae920686cd49f42949db229cd78761879dd0471829308d2ad3d74f8879acaecc7fb95e48cc78ce4110fb66f53dd71beeadc85de805a6e9ec287cc4757e14ae383faf5780b4729c1d57c3c4bf04c4934059
#TRUST-RSA-SHA256 8e6f9abf5afa90233803428174e79ba0f67b95e8f9fa5d4df37eff3410d666aa880f8e7e0b3ba4a3e0761d74464e0147f87374c8898dd68e03655f0240078bbad7a55c364b6a587a7775c7c51ab8dc4b8ff56dfbab39cd0c84c954fb6305ededdfd8182e9479284b85ed26d410fdd8bee2f63d2c72d6d8c7b434503e64f0e1e7ae4dc26334137d3179d289d9d67578d6b004a8e8f1ec4c597beadc987d8a3d90901379184748ac82c62f7c459603041e014051fa6c7e9e4c0e1e91ab6cfcf186933f59709c8dcb37d610558a4412bb31cb7ef0af5a39c87716b3dafe8da6c9d04c9558693ab258b83b0ac32b5b2cc1a8909acd03993fc71c280654aeb627aeae5b3d84a1b6bf90ca555796a824aebfa46c8668970a9aa1d17f6e7a7af39a77614637b11b801ce917b7cbdef0c5618aa024d3ea5f2ef75884f8f57b702682bb3231e29545154dd3c23ac752c1e739ef184a503387acff767c1d0bd32827514bd710ebd1305bba271d689d827abe86efe27bbc63b838a8a19a6c2899f8e726c824a34dbd70bd0a23123433663a71ab075ef2f3d36afac03c873f16e495d82dc72fe834ed876b4595918da018a850031bd5a5dfce652c9477ab83a291edc165fbea4b414a3db062b42c2b7d3bd83ed4514f93adcbe1bdf6e8463ca79167407a08c419c863aafcb921da60f22e5b4ddcf44368fe8db593be72895c9943ba16fa5cf1
#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(237760);
  script_version("1.4");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/03/13");

  script_cve_id("CVE-2025-20130");
  script_xref(name:"CISCO-BUG-ID", value:"CSCwj33565");
  script_xref(name:"CISCO-SA", value:"cisco-sa-ise-file-upload-P4M8vwXY");
  script_xref(name:"IAVA", value:"2025-A-0401-S");

  script_name(english:"Cisco Identity Services Engine (cisco-sa-ise-file-upload-P4M8vwXY)");

  script_set_attribute(attribute:"synopsis", value:
"The remote device is missing a vendor-supplied security patch.");
  script_set_attribute(attribute:"description", value:
"According to its self-reported version, Cisco ISE is affected by a vulnerability.

  - A vulnerability in the API of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity
    Connector (ISE-PIC) could allow an authenticated, remote attacker with administrative privileges to upload
    files to an affected device. This vulnerability is due to improper validation of the file copy function.
    An attacker could exploit this vulnerability by sending a crafted file upload request to a specific API
    endpoint. A successful exploit could allow the attacker to upload arbitrary files to an affected system.
    (CVE-2025-20130)

Please see the included Cisco BIDs and Cisco Security Advisory for more information.");
  # https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-file-upload-P4M8vwXY
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?1b48f924");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwj33565");
  script_set_attribute(attribute:"solution", value:
"Upgrade to the relevant fixed version referenced in Cisco bug ID CSCwj33565");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:M/C:N/I:C/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-20130");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(284);

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/06/04");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/06/04");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/06/04");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/h:cisco:identity_services_engine");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:cisco:identity_services_engine");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:cisco:identity_services_engine_software");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CISCO");

  script_copyright(english:"This script is Copyright (C) 2025-2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("cisco_ise_detect.nbin");
  script_require_keys("Host/Cisco/ISE/version");

  exit(0);
}

include('ccf.inc');
include('cisco_ise_func.inc');

var product_info = cisco::get_product_info(name:'Cisco Identity Services Engine Software');

product_info = strip_fourth_segment(product_info:product_info);

var vuln_ranges = [
 {'min_ver': '1.0', 'fix_ver': '3.1', 'required_patch': '10'},
 {'min_ver': '3.2', 'fix_ver': '3.2', 'required_patch': '7'},
 {'min_ver': '3.3', 'fix_ver': '3.3', 'required_patch': '3'}
];

var required_patch = get_required_patch(vuln_ranges:vuln_ranges, version:product_info['version']);

var reporting = make_array(
  'port'          , 0,
  'severity'      , SECURITY_WARNING,
  'version'       , product_info['version'],
  'bug_id'        , 'CSCwj33565',
  'disable_caveat', TRUE,
  'fix'           , 'See vendor advisory'
);

cisco::check_and_report(
  product_info:product_info,
  reporting:reporting,
  vuln_ranges:vuln_ranges,
  required_patch:required_patch
);