6.5

CVE-2021-1416

Multiple vulnerabilities in the Admin portal of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to obtain sensitive information. These vulnerabilities are due to improper enforcement of administrator privilege levels for sensitive data. An attacker with read-only administrator access to the Admin portal could exploit these vulnerabilities by browsing to one of the pages that contains sensitive data. A successful exploit could allow the attacker to collect sensitive information regarding the configuration of the system. For more information about these vulnerabilities, see the Details section of this advisory.

Data is provided by the National Vulnerability Database (NVD)
Cisco ≫ Identity Services Engine Version < 2.3.0
Cisco ≫ Identity Services Engine Version2.3.0 Update-
Cisco ≫ Identity Services Engine Version2.3.0 Updatepatch1
Cisco ≫ Identity Services Engine Version2.3.0 Updatepatch2
Cisco ≫ Identity Services Engine Version2.3.0 Updatepatch3
Cisco ≫ Identity Services Engine Version2.3.0 Updatepatch4
Cisco ≫ Identity Services Engine Version2.3.0 Updatepatch5
Cisco ≫ Identity Services Engine Version2.3.0 Updatepatch6
Cisco ≫ Identity Services Engine Version2.3.0 Updatepatch7
Cisco ≫ Identity Services Engine Version2.4.0 Update-
Cisco ≫ Identity Services Engine Version2.4.0 Updatepatch1
Cisco ≫ Identity Services Engine Version2.4.0 Updatepatch10
Cisco ≫ Identity Services Engine Version2.4.0 Updatepatch11
Cisco ≫ Identity Services Engine Version2.4.0 Updatepatch12
Cisco ≫ Identity Services Engine Version2.4.0 Updatepatch13
Cisco ≫ Identity Services Engine Version2.4.0 Updatepatch2
Cisco ≫ Identity Services Engine Version2.4.0 Updatepatch3
Cisco ≫ Identity Services Engine Version2.4.0 Updatepatch4
Cisco ≫ Identity Services Engine Version2.4.0 Updatepatch5
Cisco ≫ Identity Services Engine Version2.4.0 Updatepatch6
Cisco ≫ Identity Services Engine Version2.4.0 Updatepatch7
Cisco ≫ Identity Services Engine Version2.4.0 Updatepatch8
Cisco ≫ Identity Services Engine Version2.4.0 Updatepatch9
Cisco ≫ Identity Services Engine Version2.6.0 Update-
Cisco ≫ Identity Services Engine Version2.6.0 Updatepatch1
Cisco ≫ Identity Services Engine Version2.6.0 Updatepatch2
Cisco ≫ Identity Services Engine Version2.6.0 Updatepatch3
Cisco ≫ Identity Services Engine Version2.6.0 Updatepatch5
Cisco ≫ Identity Services Engine Version2.6.0 Updatepatch6
Cisco ≫ Identity Services Engine Version2.6.0 Updatepatch7
Cisco ≫ Identity Services Engine Version2.6.0 Updatepatch8
Cisco ≫ Identity Services Engine Version2.7.0 Update-
Cisco ≫ Identity Services Engine Version2.7.0 Updatepatch2
Cisco ≫ Identity Services Engine Version3.0.0 Update-
Cisco ≫ Identity Services Engine Version3.0.0 Updatepatch1
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.29% 0.516
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 4.3 2.8 1.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
nvd@nist.gov 4 8 2.9
AV:N/AC:L/Au:S/C:P/I:N/A:N
psirt@cisco.com 6.5 2.8 3.6
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CWE-266 Incorrect Privilege Assignment

A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.

CWE-269 Improper Privilege Management

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.