6.5

CVE-2022-20819

Cisco Identity Services Engine Sensitive Information Disclosure Vulnerability

A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to obtain sensitive information from an affected device. This vulnerability exists because administrative privilege levels for sensitive data are not properly enforced. An attacker with read-only privileges for the web-based management interface on an affected device could exploit this vulnerability by browsing to a page that contains sensitive data. A successful exploit could allow the attacker to collect sensitive information about the system configuration.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Cisco ≫ Identity Services Engine Version < 2.4.0.357
Cisco ≫ Identity Services Engine Version >= 2.6. < 2.6.0.156
Cisco ≫ Identity Services Engine Version >= 2.7 < 2.7.0.305
Cisco ≫ Identity Services Engine Version 2.4.0.357 Update -
Cisco ≫ Identity Services Engine Version 2.4.0.357 Update patch1
Cisco ≫ Identity Services Engine Version 2.4.0.357 Update patch10
Cisco ≫ Identity Services Engine Version 2.4.0.357 Update patch2
Cisco ≫ Identity Services Engine Version 2.4.0.357 Update patch3
Cisco ≫ Identity Services Engine Version 2.4.0.357 Update patch4
Cisco ≫ Identity Services Engine Version 2.4.0.357 Update patch5
Cisco ≫ Identity Services Engine Version 2.4.0.357 Update patch6
Cisco ≫ Identity Services Engine Version 2.4.0.357 Update patch7
Cisco ≫ Identity Services Engine Version 2.4.0.357 Update patch8
Cisco ≫ Identity Services Engine Version 2.4.0.357 Update patch9
Cisco ≫ Identity Services Engine Version 2.6.0.156 Update patch1
Cisco ≫ Identity Services Engine Version 2.6.0.156 Update patch2
Cisco ≫ Identity Services Engine Version 2.6.0.156 Update patch3
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.94% 0.577
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 6.5 2.8 3.6
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
NIST 4 8 2.9
AV:N/AC:L/Au:S/C:P/I:N/A:N
Cisco PSIRT 6.5 2.8 3.6
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CWE-266 Incorrect Privilege Assignment

A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.

CWE-269 Improper Privilege Management

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-info-disclosure-Os6fSd6N
Vendor Advisory