6.5

CVE-2022-20782

Cisco Identity Services Engine Sensitive Information Disclosure Vulnerability

A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to obtain sensitive information from an affected device. This vulnerability is due to improper enforcement of administrative privilege levels for high-value sensitive data. An attacker with read-only Administrator privileges to the web-based management interface on an affected device could exploit this vulnerability by browsing to a page that contains sensitive data. A successful exploit could allow the attacker to collect sensitive information regarding the configuration of the system.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Cisco ≫ Identity Services Engine Version 2.6.0 Update -
Cisco ≫ Identity Services Engine Version 2.6.0 Update patch1
Cisco ≫ Identity Services Engine Version 2.6.0 Update patch10
Cisco ≫ Identity Services Engine Version 2.6.0 Update patch2
Cisco ≫ Identity Services Engine Version 2.6.0 Update patch3
Cisco ≫ Identity Services Engine Version 2.6.0 Update patch5
Cisco ≫ Identity Services Engine Version 2.6.0 Update patch6
Cisco ≫ Identity Services Engine Version 2.6.0 Update patch7
Cisco ≫ Identity Services Engine Version 2.6.0 Update patch8
Cisco ≫ Identity Services Engine Version 2.6.0 Update patch9
Cisco ≫ Identity Services Engine Version 2.7.0 Update -
Cisco ≫ Identity Services Engine Version 2.7.0 Update patch1
Cisco ≫ Identity Services Engine Version 2.7.0 Update patch2
Cisco ≫ Identity Services Engine Version 2.7.0 Update patch3
Cisco ≫ Identity Services Engine Version 2.7.0 Update patch4
Cisco ≫ Identity Services Engine Version 2.7.0 Update patch5
Cisco ≫ Identity Services Engine Version 2.7.0 Update patch6
Cisco ≫ Identity Services Engine Version 3.0.0 Update -
Cisco ≫ Identity Services Engine Version 3.0.0 Update patch1
Cisco ≫ Identity Services Engine Version 3.0.0 Update patch2
Cisco ≫ Identity Services Engine Version 3.0.0 Update patch3
Cisco ≫ Identity Services Engine Version 3.0.0 Update patch4
Cisco ≫ Identity Services Engine Version 3.1 Update -
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.99% 0.592
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 6.5 2.8 3.6
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
NIST 4 8 2.9
AV:N/AC:L/Au:S/C:P/I:N/A:N
Cisco PSIRT 6.5 2.8 3.6
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CWE-266 Incorrect Privilege Assignment

A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.

CWE-269 Improper Privilege Management

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-info-exp-YXAWYP3s
Vendor Advisory