CVE-2018-15425
Summary
| CVE | CVE-2018-15425 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2018-10-05 14:29:00 UTC |
| Updated | 2020-09-16 13:17:00 UTC |
| Description | A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device with the privileges of the web server. |
Risk And Classification
Problem Types: CWE-502
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Cisco | Identity Services Engine | 2.1(0.474) | All | All | All |
| Application | Cisco | Identity Services Engine | 2.1(0.907) | All | All | All |
| Application | Cisco | Identity Services Engine | 2.1\(0.474\) | All | All | All |
| Application | Cisco | Identity Services Engine | 2.1\(0.907\) | All | All | All |
| Application | Cisco | Identity Services Engine | 2.2(0.470) | All | All | All |
| Application | Cisco | Identity Services Engine | 2.2(0.909) | All | All | All |
| Application | Cisco | Identity Services Engine | 2.2\(0.470\) | All | All | All |
| Application | Cisco | Identity Services Engine | 2.2\(0.909\) | All | All | All |
| Application | Cisco | Identity Services Engine | 2.3(0.298) | All | All | All |
| Application | Cisco | Identity Services Engine | 2.3(0.905) | All | All | All |
| Application | Cisco | Identity Services Engine | 2.3\(0.298\) | All | All | All |
| Application | Cisco | Identity Services Engine | 2.3\(0.905\) | All | All | All |
| Application | Cisco | Identity Services Engine | 2.4(0.357) | All | All | All |
| Application | Cisco | Identity Services Engine | 2.4(0.904) | All | All | All |
| Application | Cisco | Identity Services Engine | 2.4\(0.357\) | All | All | All |
| Application | Cisco | Identity Services Engine | 2.4\(0.904\) | All | All | All |
| Application | Cisco | Identity Services Engine | 2.1\(0.474\) | All | All | All |
| Application | Cisco | Identity Services Engine | 2.1\(0.907\) | All | All | All |
| Application | Cisco | Identity Services Engine | 2.2\(0.470\) | All | All | All |
| Application | Cisco | Identity Services Engine | 2.2\(0.909\) | All | All | All |
| Application | Cisco | Identity Services Engine | 2.3\(0.298\) | All | All | All |
| Application | Cisco | Identity Services Engine | 2.3\(0.905\) | All | All | All |
| Application | Cisco | Identity Services Engine | 2.4\(0.357\) | All | All | All |
| Application | Cisco | Identity Services Engine | 2.4\(0.904\) | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Multiple Vulnerabilities in Cisco Identity Services Engine | CISCO | tools.cisco.com | Vendor Advisory |
| Cisco Identity Services Engine File Upload and Java Deserialization Bugs Let Remote Authenticated Users Execute Arbitrary Code on the Target System - SecurityTracker | SECTRACK | www.securitytracker.com | Third Party Advisory, VDB Entry |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.