Cisco ISE Captive Portal Application Plaintext Credentials Information Disclosure Vulnerability

Bugtraq ID:	62030
Class:	Unknown
CVE:	CVE-2013-3471
Remote:	Yes
Local:	No
Published:	Aug 28 2013 12:00AM
Updated:	Aug 28 2013 12:00AM
Credit:	David Robinson of Context Information Security
Vulnerable:
Not Vulnerable:

Cisco ISE Captive Portal Application Plaintext Credentials Information Disclosure Vulnerability

The captive portal application of Cisco Identity Services Engine (ISE) is prone to an information-disclosure vulnerability.

An attacker can exploit this issue to obtain sensitive information that may aid in further attacks.

This issue is being tracked by Cisco Bug ID CSCug02515.

Cisco ISE Captive Portal Application Plaintext Credentials Information Disclosure Vulnerability

Attackers can exploit this issue by enticing unsuspecting users to follow a malicious URI or visit a crafted site.

Cisco ISE Captive Portal Application Plaintext Credentials Information Disclosure Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Cisco ISE Captive Portal Application Plaintext Credentials Information Disclosure Vulnerability

References:

• Cisco Homepage (Cisco )
  
• Cisco ISE Captive Portal Application Plaintext Credentials Exposure Vulnerabilit (Cisco)