6.5

CVE-2022-20819

A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to obtain sensitive information from an affected device. This vulnerability exists because administrative privilege levels for sensitive data are not properly enforced. An attacker with read-only privileges for the web-based management interface on an affected device could exploit this vulnerability by browsing to a page that contains sensitive data. A successful exploit could allow the attacker to collect sensitive information about the system configuration.

Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Cisco ≫ Identity Services Engine Version < 2.4.0.357
Cisco ≫ Identity Services Engine Version >= 2.6. < 2.6.0.156
Cisco ≫ Identity Services Engine Version >= 2.7 < 2.7.0.305
Cisco ≫ Identity Services Engine Version2.4.0.357 Update-
Cisco ≫ Identity Services Engine Version2.4.0.357 Updatepatch1
Cisco ≫ Identity Services Engine Version2.4.0.357 Updatepatch10
Cisco ≫ Identity Services Engine Version2.4.0.357 Updatepatch2
Cisco ≫ Identity Services Engine Version2.4.0.357 Updatepatch3
Cisco ≫ Identity Services Engine Version2.4.0.357 Updatepatch4
Cisco ≫ Identity Services Engine Version2.4.0.357 Updatepatch5
Cisco ≫ Identity Services Engine Version2.4.0.357 Updatepatch6
Cisco ≫ Identity Services Engine Version2.4.0.357 Updatepatch7
Cisco ≫ Identity Services Engine Version2.4.0.357 Updatepatch8
Cisco ≫ Identity Services Engine Version2.4.0.357 Updatepatch9
Cisco ≫ Identity Services Engine Version2.6.0.156 Updatepatch1
Cisco ≫ Identity Services Engine Version2.6.0.156 Updatepatch2
Cisco ≫ Identity Services Engine Version2.6.0.156 Updatepatch3
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.17% 0.389
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 6.5 2.8 3.6
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
nvd@nist.gov 4 8 2.9
AV:N/AC:L/Au:S/C:P/I:N/A:N
psirt@cisco.com 6.5 2.8 3.6
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CWE-266 Incorrect Privilege Assignment

A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.

CWE-269 Improper Privilege Management

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.