CVE-2020-3467
Summary
| CVE | CVE-2020-3467 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2020-10-08 05:15:00 UTC |
| Updated | 2020-10-16 16:16:00 UTC |
| Description | A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to modify parts of the configuration on an affected device. The vulnerability is due to improper enforcement of role-based access control (RBAC) within the web-based management interface. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to modify parts of the configuration. The modified configuration could either allow unauthorized devices onto the network or prevent authorized devices from accessing the network. To exploit this vulnerability, an attacker would need valid Read-Only Administrator credentials. |
Risk And Classification
Problem Types: CWE-863
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Cisco | Identity Services Engine | 2.4.0.357 | patch1 | All | All |
| Application | Cisco | Identity Services Engine | 2.4.0.357 | patch10 | All | All |
| Application | Cisco | Identity Services Engine | 2.4.0.357 | patch11 | All | All |
| Application | Cisco | Identity Services Engine | 2.4.0.357 | patch12 | All | All |
| Application | Cisco | Identity Services Engine | 2.4.0.357 | patch2 | All | All |
| Application | Cisco | Identity Services Engine | 2.4.0.357 | patch3 | All | All |
| Application | Cisco | Identity Services Engine | 2.4.0.357 | patch4 | All | All |
| Application | Cisco | Identity Services Engine | 2.4.0.357 | patch5 | All | All |
| Application | Cisco | Identity Services Engine | 2.4.0.357 | patch6 | All | All |
| Application | Cisco | Identity Services Engine | 2.4.0.357 | patch7 | All | All |
| Application | Cisco | Identity Services Engine | 2.4.0.357 | patch8 | All | All |
| Application | Cisco | Identity Services Engine | 2.4.0.357 | patch9 | All | All |
| Application | Cisco | Identity Services Engine | 2.4\(0.357\) | All | All | All |
| Application | Cisco | Identity Services Engine | 2.5 | All | All | All |
| Application | Cisco | Identity Services Engine | 2.6.0 | - | All | All |
| Application | Cisco | Identity Services Engine | 2.6.0.156 | patch1 | All | All |
| Application | Cisco | Identity Services Engine | 2.6.0.156 | patch2 | All | All |
| Application | Cisco | Identity Services Engine | 2.6.0.156 | patch3 | All | All |
| Application | Cisco | Identity Services Engine | 2.6.0.156 | patch5 | All | All |
| Application | Cisco | Identity Services Engine | 2.6.0.156 | patch6 | All | All |
| Application | Cisco | Identity Services Engine | 2.6\(0.156\) | All | All | All |
| Application | Cisco | Identity Services Engine | 2.7 | All | All | All |
| Application | Cisco | Identity Services Engine | 2.7.0.356 | patch1 | All | All |
| Application | Cisco | Identity Services Engine | 2.7\(0.356\) | All | All | All |
| Application | Cisco | Identity Services Engine | 2.4.0.357 | patch1 | All | All |
| Application | Cisco | Identity Services Engine | 2.4.0.357 | patch10 | All | All |
| Application | Cisco | Identity Services Engine | 2.4.0.357 | patch11 | All | All |
| Application | Cisco | Identity Services Engine | 2.4.0.357 | patch12 | All | All |
| Application | Cisco | Identity Services Engine | 2.4.0.357 | patch2 | All | All |
| Application | Cisco | Identity Services Engine | 2.4.0.357 | patch3 | All | All |
| Application | Cisco | Identity Services Engine | 2.4.0.357 | patch4 | All | All |
| Application | Cisco | Identity Services Engine | 2.4.0.357 | patch5 | All | All |
| Application | Cisco | Identity Services Engine | 2.4.0.357 | patch6 | All | All |
| Application | Cisco | Identity Services Engine | 2.4.0.357 | patch7 | All | All |
| Application | Cisco | Identity Services Engine | 2.4.0.357 | patch8 | All | All |
| Application | Cisco | Identity Services Engine | 2.4.0.357 | patch9 | All | All |
| Application | Cisco | Identity Services Engine | 2.4\(0.357\) | All | All | All |
| Application | Cisco | Identity Services Engine | 2.5 | All | All | All |
| Application | Cisco | Identity Services Engine | 2.6.0 | - | All | All |
| Application | Cisco | Identity Services Engine | 2.6.0.156 | patch1 | All | All |
| Application | Cisco | Identity Services Engine | 2.6.0.156 | patch2 | All | All |
| Application | Cisco | Identity Services Engine | 2.6.0.156 | patch3 | All | All |
| Application | Cisco | Identity Services Engine | 2.6.0.156 | patch5 | All | All |
| Application | Cisco | Identity Services Engine | 2.6.0.156 | patch6 | All | All |
| Application | Cisco | Identity Services Engine | 2.6\(0.156\) | All | All | All |
| Application | Cisco | Identity Services Engine | 2.7 | All | All | All |
| Application | Cisco | Identity Services Engine | 2.7.0.356 | patch1 | All | All |
| Application | Cisco | Identity Services Engine | 2.7\(0.356\) | All | All | All |
| Application | Cisco | Identity Services Engine | All | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Cisco Identity Services Engine Authorization Bypass Vulnerability | CISCO | tools.cisco.com | Vendor Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 317081 Cisco Identity Services Engine (ISE) Authorization Bypass Vulnerability (cisco-sa-ise-auth-bypass-uJWqLTZM)