Cisco Identity Services Engine (cisco-sa-ise-file-upload-qksX6C8g)

#TRUSTED a0b9676222743c439b3283c80b3bb24ad63e8292926b67be5bd4cc5c408302ab65573802b3a350928cce2c5fc9e13ff4ce18976d43b595135090b07a591891d0fb244ea628d0ebd58a5f67bed24e89fdaaf90a72f1f35882537993149fae57072b2b327d18c30456a9af6d8b89f6b9fd548c8b5c5f1efd1952df9e35d15d9c8b8c18b7fc6c867760980c5afe870149599da9f323ae5722aa72be083046afbc836c1b8c0551bfd0e895b33e60871570793140bcd2f9ff331543f9dc9d1e0ee227887b407bad1bb2a9d276f59fde8933d782ed183b3c265c929b9554947d930a32ea2a51beaedff77c5c50af65a3a08664a0375430d12a386e5e642a5666d24f380e521ec82add1872a42bb1d0b9960c676fb3b0d09a903a0f87feb4aac71d66e9a901f2a7a7aedf1b7e1b3ce38c0728e3965554f218b1977de5e8e47da534d61a9fa02c6b465c6884b2db9864c3bc48501e52b5a106e3425df1d5dce8191772371d03e60bb70c778a46ce3c053bb91022a70911c5b1fd02ab230d030120b1300f3603a47e20bf1f7969257f9915f231069b3cf4df293d6f8bed9335f061dbba651a811a6b2aed2e7f68ad499809b7b7071d1df3d589962c351f44d0830fc302a509269ae1cbdb7144e0b44b83c0e800c39c965d561834aef0890b7f6098e0a29b0fc90f78879a0b6619e1bd1d2e20e44e0c6dbb7f637c31ac8b9052a2383e0e04
#TRUST-RSA-SHA256 286c9a727a1ee190cce6e7e65345a87b422e5b50d0a72fa5d02ae19a30fe621ee96e5ad10dbdb6afd3df80be6fd53cb5b006f2ad83fbda14226f921fcfec743901cf0290914bf0c9a50ccd9646954a1883c71916f9a930ce8350a0837dcc3e0ca536786bfe10a8d57223c7dee5570956991e1a1edc78f87edcde5a6ca5877d8011f0da0881639ac2734a78b7162c80c4d21498c46a218fbd8076b22f51a6383b88ec8d7b1c18e106afbd996ac4ae67d4f2cee6f5ad93ec66bb79bbcf1b16a236975cd3b2e827a12be933992bb25184ed9b77c2732f50180c73f38da7fe2d6fa7987d79684bd8ef86cc2c3ec72fd817cf3eae516bfa65df1053cb0abc164e9579b481d8e0489383da2cc177b224b570713184b7c1870b2caf229527aacba67d5c5556fede27d4b58abda8a92e9a8b5ca7d0b1d6ed75d727df69f5816abbbbd727800e4a0a68960b02b6e857e1c79ddc9095a8d51b39369332323d143e0b6503e623b48d380c32604348f17b2e5fc1e0b60dc8af8c3d95a5d502f3308f8e0bce9ca3a67a42c0e9749ac54b9691ee36b9c9952a5520510b8429fa32ef833823f32b29720310b62baf86f93a8c14295f6a051285334dd1d0b4ce7e8573f00d4268b051c9430edb3c65e56cbb66f9ec3372dacc379c5bb32ede78babd33b5edbfe15bf67ee971481012af4889b81382869d00c4cfb1fcee9db07cb062f49c4044cd22
#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(253042);
  script_version("1.4");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/03/13");

  script_cve_id("CVE-2025-20131");
  script_xref(name:"CISCO-BUG-ID", value:"CSCwj33527");
  script_xref(name:"CISCO-SA", value:"cisco-sa-ise-file-upload-qksX6C8g");
  script_xref(name:"IAVA", value:"2025-A-0583-S");

  script_name(english:"Cisco Identity Services Engine (cisco-sa-ise-file-upload-qksX6C8g)");

  script_set_attribute(attribute:"synopsis", value:
"The remote device is missing a vendor-supplied security patch.");
  script_set_attribute(attribute:"description", value:
"According to its self-reported version, Cisco ISE is affected by a vulnerability.

  - A vulnerability in the GUI of Cisco Identity Services Engine (ISE) could allow an authenticated, remote
    attacker with administrative privileges to upload files to an affected device. This vulnerability is due
    to improper validation of the file copy function. An attacker could exploit this vulnerability by sending
    a crafted file upload via the ISE GUI. A successful exploit could allow the attacker to upload arbitrary
    files to an affected system. (CVE-2025-20131)

Please see the included Cisco BIDs and Cisco Security Advisory for more information.");
  # https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-file-upload-qksX6C8g
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?9a10fb37");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwj33527");
  script_set_attribute(attribute:"solution", value:
"Upgrade to the relevant fixed version referenced in Cisco bug ID CSCwj33527");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:M/C:N/I:C/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-20131");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(284);

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/08/20");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/08/20");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/08/20");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/h:cisco:identity_services_engine");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:cisco:identity_services_engine");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:cisco:identity_services_engine_software");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_set_attribute(attribute:"stig_severity", value:"II");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CISCO");

  script_copyright(english:"This script is Copyright (C) 2025-2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("cisco_ise_detect.nbin");
  script_require_keys("Host/Cisco/ISE/version");

  exit(0);
}

include('ccf.inc');
include('cisco_ise_func.inc');

var product_info = cisco::get_product_info(name:'Cisco Identity Services Engine Software');

product_info = strip_fourth_segment(product_info:product_info);

var vuln_ranges = [
 {'min_ver': '1.0', 'fix_ver': '3.1', 'required_patch': '10'},
 {'min_ver': '3.2', 'fix_ver': '3.2', 'required_patch': '7'},
 {'min_ver': '3.3', 'fix_ver': '3.3', 'required_patch': '3'}
];

var required_patch = get_required_patch(vuln_ranges:vuln_ranges, version:product_info['version']);

var reporting = make_array(
  'port'          , 0,
  'severity'      , SECURITY_WARNING,
  'version'       , product_info['version'],
  'bug_id'        , 'CSCwj33527',
  'disable_caveat', TRUE,
  'fix'           , 'See vendor advisory'
);

cisco::check_and_report(
  product_info:product_info,
  reporting:reporting,
  vuln_ranges:vuln_ranges,
  required_patch:required_patch
);