5.4
CVE-2022-20965
- EPSS 0.61%
- Veröffentlicht 20.01.2023 07:15:11
- Zuletzt bearbeitet 21.11.2024 06:43:55
- Erkennungen
A vulnerability in the web-based management interface of Cisco Identity Services Engine could allow an authenticated, remote attacker to take privileges actions within the web-based management interface.
This vulnerability is due to improper access control on a feature within the web-based management interface of the affected system. An attacker could exploit this vulnerability by accessing features through direct requests, bypassing checks within the application. A successful exploit could allow the attacker to take privileged actions within the web-based management interface that should be otherwise restricted.
{{value}} ["%7b%7bvalue%7d%7d"])}]]
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Cisco ≫ Identity Services Engine Version < 2.6.0
Cisco ≫ Identity Services Engine Version 2.6.0 Update -
Cisco ≫ Identity Services Engine Version 2.6.0 Update patch1
Cisco ≫ Identity Services Engine Version 2.6.0 Update patch10
Cisco ≫ Identity Services Engine Version 2.6.0 Update patch11
Cisco ≫ Identity Services Engine Version 2.6.0 Update patch12
Cisco ≫ Identity Services Engine Version 2.6.0 Update patch2
Cisco ≫ Identity Services Engine Version 2.6.0 Update patch3
Cisco ≫ Identity Services Engine Version 2.6.0 Update patch5
Cisco ≫ Identity Services Engine Version 2.6.0 Update patch6
Cisco ≫ Identity Services Engine Version 2.6.0 Update patch7
Cisco ≫ Identity Services Engine Version 2.6.0 Update patch8
Cisco ≫ Identity Services Engine Version 2.6.0 Update patch9
Cisco ≫ Identity Services Engine Version 2.7.0 Update -
Cisco ≫ Identity Services Engine Version 2.7.0 Update patch1
Cisco ≫ Identity Services Engine Version 2.7.0 Update patch2
Cisco ≫ Identity Services Engine Version 2.7.0 Update patch3
Cisco ≫ Identity Services Engine Version 2.7.0 Update patch4
Cisco ≫ Identity Services Engine Version 2.7.0 Update patch5
Cisco ≫ Identity Services Engine Version 2.7.0 Update patch6
Cisco ≫ Identity Services Engine Version 2.7.0 Update patch7
Cisco ≫ Identity Services Engine Version 3.0.0 Update -
Cisco ≫ Identity Services Engine Version 3.0.0 Update patch1
Cisco ≫ Identity Services Engine Version 3.0.0 Update patch2
Cisco ≫ Identity Services Engine Version 3.0.0 Update patch3
Cisco ≫ Identity Services Engine Version 3.0.0 Update patch4
Cisco ≫ Identity Services Engine Version 3.0.0 Update patch5
Cisco ≫ Identity Services Engine Version 3.0.0 Update patch6
Cisco ≫ Identity Services Engine Version 3.1 Update -
Cisco ≫ Identity Services Engine Version 3.1 Update patch1
Cisco ≫ Identity Services Engine Version 3.1 Update patch3
Cisco ≫ Identity Services Engine Version 3.1 Update patch4
Cisco ≫ Identity Services Engine Version 3.2 Update -
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.61% | 0.443 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| NIST | 5.4 | 2.8 | 2.5 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
|
| Cisco PSIRT | 4.3 | 2.8 | 1.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
|
CWE-648 Incorrect Use of Privileged APIs
The product does not conform to the API requirements for a function call that requires extra privileges. This could allow attackers to gain privileges by causing the function to be called incorrectly.
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-7Q4TNYUx