6.5

CVE-2021-40123

Cisco Identity Services Engine File Download Vulnerability

A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker with administrative read-only privileges to download files that should be restricted. This vulnerability is due to incorrect permissions settings on an affected device. An attacker could exploit this vulnerability by sending a crafted HTTP request to the device. A successful exploit could allow the attacker to download files that should be restricted.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Cisco ≫ Identity Services Engine Version <= 2.6
Cisco ≫ Identity Services Engine Version 2.6.0 Update -
Cisco ≫ Identity Services Engine Version 2.6.0 Update patch1
Cisco ≫ Identity Services Engine Version 2.6.0 Update patch2
Cisco ≫ Identity Services Engine Version 2.6.0 Update patch3
Cisco ≫ Identity Services Engine Version 2.6.0 Update patch5
Cisco ≫ Identity Services Engine Version 2.6.0 Update patch6
Cisco ≫ Identity Services Engine Version 2.6.0 Update patch7
Cisco ≫ Identity Services Engine Version 2.6.0 Update patch8
Cisco ≫ Identity Services Engine Version 2.6.0 Update patch9
Cisco ≫ Identity Services Engine Version 2.7(0.207)
Cisco ≫ Identity Services Engine Version 2.7(0.356)
Cisco ≫ Identity Services Engine Version 2.7(0.356) Update -
Cisco ≫ Identity Services Engine Version 2.7(0.903)
Cisco ≫ Identity Services Engine Version 2.7.0 Update -
Cisco ≫ Identity Services Engine Version 2.7.0 Update patch1
Cisco ≫ Identity Services Engine Version 2.7.0 Update patch2
Cisco ≫ Identity Services Engine Version 2.7.0 Update patch3
Cisco ≫ Identity Services Engine Version 2.7.0 Update patch4
Cisco ≫ Identity Services Engine Version 3.0(0.458)
Cisco ≫ Identity Services Engine Version 3.0.0 Update -
Cisco ≫ Identity Services Engine Version 3.0.0 Update patch1
Cisco ≫ Identity Services Engine Version 3.0.0 Update patch2
Cisco ≫ Identity Services Engine Version 3.0.0 Update patch3
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.8% 0.533
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 6.5 2.8 3.6
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
NIST 4 8 2.9
AV:N/AC:L/Au:S/C:P/I:N/A:N
Cisco PSIRT 4.3 2.8 1.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CWE-266 Incorrect Privilege Assignment

A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.

CWE-276 Incorrect Default Permissions

During installation, installed file permissions are set to allow anyone to modify those files.

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-file-download-B3BR5KQA
Vendor Advisory