Published on: Not Yet Published
Last Modified on: 11/08/2022 03:44:00 PM UTC
CVE-2022-20962 - advisory for cisco-sa-ise-path-trav-f6M7cs6rSource: Mitre Source: NIST CVE.ORG Print: PDF
A vulnerability in the Localdisk Management feature of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to make unauthorized changes to the file system of an affected device. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending a crafted HTTP request with absolute path sequences. A successful exploit could allow the attacker to upload malicious files to arbitrary locations within the file system. Using this method, it is possible to access the underlying operating system and execute commands with system privileges.
- CVE-2022-20962 has been assigned by [email protected] to track the vulnerability - currently rated as HIGH severity.
- The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory.
- Affected Vendor/Software: Cisco - Cisco Identity Services Engine Software version = 3.1.0
- Affected Vendor/Software: Cisco - Cisco Identity Services Engine Software version = 3.1.0 p1
- Affected Vendor/Software: Cisco - Cisco Identity Services Engine Software version = 3.1.0 p3
CVSS3 Score: 8.8 - HIGH
|No Description Provided|| tools.cisco.com |
Related QID Numbers
- 317261 Cisco Identity Services Engine (ISE) Path Traversal Vulnerability (cisco-sa-ise-path-trav-f6M7cs6r)
Known Affected Configurations (CPE V2.3)
|Application||Cisco||Identity Services Engine||3.1||-||All||All|
|Application||Cisco||Identity Services Engine||3.1||patch1||All||All|
|Application||Cisco||Identity Services Engine||3.1||patch3||All||All|