QID 317275

Date Published: 2022-11-21

QID 317275: Cisco Identity Services Engine (ISE) Insufficient Access Control Vulnerability (cisco-sa-ise-access-contol-EeufSUCx)

A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to bypass authorization and access system files.

Affected Products
Cisco ISE following vulnerable versions:
Cisco ISE 3.1
Cisco ISE 3.2
Note: Cisco ISE releases 3.1P4 and 3.2 reduce the impact of this vulnerability by preventing files from being downloaded. The files can still be listed and deleted. This fix is tracked in CSCwb75965.

Note: Cisco ISE releases 3.1P4 and 3.2P1 further reduce the impact of this vulnerability by limiting the accessible files to the localdisk folder only. For more information about the localdisk folder, see the ISE 3.1 Release Notes. This fix is tracked in CSCwc62413.

Note: Patch for the version 3.1 and 3.2 will be updated once vendor updates the patch information.

QID Detection Logic (Authenticated):
The check matches the Cisco ISE version and ise_patch retrieved via Unix Auth using "show version" command.

A successful exploit could allow the attacker to list, download, and delete certain files that they should not have access to.

  • CVSS V3 rated as Critical - 8.8 severity.
  • CVSS V2 rated as High - 7.5 severity.
    • Solution

    Customers are advised to refer to cisco-sa-ise-access-contol-EeufSUCx for more information.

    Vendor References

    CVEs related to QID 317275

    CVE-2022-20956 |
    Software Advisories
    Advisory ID Software Component Link
    cisco-sa-ise-access-contol-EeufSUCx URL Logo tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-access-contol-EeufSUCx
    By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].