CVE-2023-20111

CVE-2023-20111 affects Cisco Identity Services Engine (ISE). The issue is an improper storage of sensitive information in the web-based management interface, allowing an authenticated, remote attacker to log in and view hidden fields, potentially exposing credentials and enabling further attacks....

Cisco Identity Services Engine Path Traversal Vulnerability

Cisco Identity Services Engine ISE is an environment-aware platform ISE Identity Services Engine from Cisco. The platform collects real-time information from the network, users and devices, and develops and enforces policies to regulate the network. A path traversal vulnerability exists in Cisco...

Cisco Identity Services Engine Path Traversal Vulnerability (cisco-sa-ise-traversal-ZTUgMYhu) (CSCwd07350)

According to its self-reported version, Cisco Identity Services Engine Path Traversal Vulnerabilities is affected by a path traversal vulnerability. A vulnerability in the CLI of Cisco ISE could allow an authenticated, local attacker to perform a path traversal attack to escape the restricted she...

Cisco Identity Services Engine Command Injection Vulnerability (cisco-sa-ise-injection-sRQnsEU9)

According to its self-reported version, Cisco Identity Services Engine is affected by a command injection vulnerability, which could allow an authenticated remote attacker to perform command injection attacks on the underlying operating system and elevate privileges to root. To exploit these...

Input validation

Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine ISE could allow an authenticated, remote attacker to download arbitrary files from the filesystem of an affected device. These vulnerabilities are due to insufficient input validation. An attacker cou...

CVE-2023-20172

Cisco Identity Services Engine (ISE) is affected by CVE-2023-20172, describing multiple vulnerabilities in ISE that could allow an authenticated attacker to delete or read arbitrary files on the underlying OS. The issues appear to be tied to the web interface and require valid credentials on an a...

CVE-2023-20077

CVE-2023-20077 affects Cisco Identity Services Engine (ISE). The web-based management interface contains input-validation vulnerabilities that allow an authenticated, remote attacker to download arbitrary files from the device filesystem by sending crafted HTTP requests. Impact is confirmed as ar...

CVE-2023-20164

CVE-2023-20164 affects Cisco Identity Services Engine (ISE). The vulnerability is a command injection in ISE that could allow an authenticated attacker (with valid credentials on an affected device) to execute commands on the underlying OS and potentially gain root privileges. Exploitation detail...

CVE-2023-20087

Summary: CVE-2023-20087 affects Cisco Identity Services Engine (ISE) where the web-based management interface contains input-validation errors that could let an authenticated, remote attacker download arbitrary files from the device filesystem by sending crafted HTTP requests. This is supported b...

CVE-2023-20174

Cisco ISE CVE-2023-20174 refers to multiple vulnerabilities in the web-based management interface, stemming from XML External Entity Injection. When authenticated as an administrator, an attacker could read arbitrary files or perform SSRF via the affected device. The root cause is XML handling in...

CVE-2023-20173

Cisco Identity Services Engine (ISE) is affected by CVE-2023-20173, an XML External Entity Injection vulnerability in the web-based management interface that can allow an authenticated, remote attacker with valid Administrator credentials to read arbitrary files or perform SSRF. The exploitation ...

CVE-2023-20171: Client-Side Enforcement of Server-Side Security

Multiple vulnerabilities in Cisco Identity Services Engine ISE could allow an authenticated attacker to delete or read arbitrary files on the underlying operating system. To exploit these vulnerabilities, an attacker must have valid credentials on an affected device. For more information about...

CVE-2023-20163: Improper Neutralization of Special Elements used in an OS Command

Multiple vulnerabilities in Cisco Identity Services Engine ISE could allow an authenticated attacker to perform command injection attacks on the underlying operating system and elevate privileges to root. To exploit these vulnerabilities, an attacker must have valid credentials on an affected...

CVE-2023-20171

Cisco Identity Services Engine (ISE) is affected by CVE-2023-20171: authenticated, credentialed attackers can delete or read arbitrary files on the OS. Affected versions include Cisco ISE 3.1.x before 3.1P6 and 3.2.x before 3.2P2. Cisco and third-party advisories (e.g., Cisco security advisory ci...

CVE-2023-20106

Cisco Identity Services Engine (ISE) contains authenticated-file-delete/read vulnerabilities (CVE-2023-20106) that allow an attacker with valid credentials to delete or read arbitrary OS files. Affected lines point to ISE releases prior to 3.1P6 (3.1.x) and prior to 3.2P2 (3.2.x). The Cisco advis...

CVE-2023-20167

Cisco Identity Services Engine (ISE) contains path traversal vulnerabilities that could let an authenticated Administrator read arbitrary files on the underlying OS or escalate to root. The issue affects ISE’s web management interface and is caused by improper validation of user-supplied input, r...

CVE-2023-20087 Cisco Identity Services Engine Arbitrary File Download Vulnerabilities

Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine ISE could allow an authenticated, remote attacker to download arbitrary files from the filesystem of an affected device. These vulnerabilities are due to insufficient input validation. An attacker cou...

CVE-2023-20172: Client-Side Enforcement of Server-Side Security

Multiple vulnerabilities in Cisco Identity Services Engine ISE could allow an authenticated attacker to delete or read arbitrary files on the underlying operating system. To exploit these vulnerabilities, an attacker must have valid credentials on an affected device. For more information about...

CVE-2023-20077 Cisco Identity Services Engine Arbitrary File Download Vulnerabilities

Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine ISE could allow an authenticated, remote attacker to download arbitrary files from the filesystem of an affected device. These vulnerabilities are due to insufficient input validation. An attacker cou...

CVE-2023-20163

CVE-2023-20163 concerns Cisco Identity Services Engine (ISE) command injection vulnerabilities. The affected product is ISE; the underlying issue enables an authenticated attacker with valid credentials to perform command injections on the OS and elevate to root. Exploitation context and impact a...