5.4

CVE-2022-20965

A vulnerability in the web-based management interface of Cisco Identity Services Engine could allow an authenticated, remote attacker to take privileges actions within the web-based management interface.

 This vulnerability is due to improper access control on a feature within the web-based management interface of the affected system. An attacker could exploit this vulnerability by accessing features through direct requests, bypassing checks within the application. A successful exploit could allow the attacker to take privileged actions within the web-based management interface that should be otherwise restricted.

    

  {{value}} ["%7b%7bvalue%7d%7d"])}]]
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Cisco ≫ Identity Services Engine Version < 2.6.0
Cisco ≫ Identity Services Engine Version 2.6.0 Update -
Cisco ≫ Identity Services Engine Version 2.6.0 Update patch1
Cisco ≫ Identity Services Engine Version 2.6.0 Update patch10
Cisco ≫ Identity Services Engine Version 2.6.0 Update patch11
Cisco ≫ Identity Services Engine Version 2.6.0 Update patch12
Cisco ≫ Identity Services Engine Version 2.6.0 Update patch2
Cisco ≫ Identity Services Engine Version 2.6.0 Update patch3
Cisco ≫ Identity Services Engine Version 2.6.0 Update patch5
Cisco ≫ Identity Services Engine Version 2.6.0 Update patch6
Cisco ≫ Identity Services Engine Version 2.6.0 Update patch7
Cisco ≫ Identity Services Engine Version 2.6.0 Update patch8
Cisco ≫ Identity Services Engine Version 2.6.0 Update patch9
Cisco ≫ Identity Services Engine Version 2.7.0 Update -
Cisco ≫ Identity Services Engine Version 2.7.0 Update patch1
Cisco ≫ Identity Services Engine Version 2.7.0 Update patch2
Cisco ≫ Identity Services Engine Version 2.7.0 Update patch3
Cisco ≫ Identity Services Engine Version 2.7.0 Update patch4
Cisco ≫ Identity Services Engine Version 2.7.0 Update patch5
Cisco ≫ Identity Services Engine Version 2.7.0 Update patch6
Cisco ≫ Identity Services Engine Version 2.7.0 Update patch7
Cisco ≫ Identity Services Engine Version 3.0.0 Update -
Cisco ≫ Identity Services Engine Version 3.0.0 Update patch1
Cisco ≫ Identity Services Engine Version 3.0.0 Update patch2
Cisco ≫ Identity Services Engine Version 3.0.0 Update patch3
Cisco ≫ Identity Services Engine Version 3.0.0 Update patch4
Cisco ≫ Identity Services Engine Version 3.0.0 Update patch5
Cisco ≫ Identity Services Engine Version 3.0.0 Update patch6
Cisco ≫ Identity Services Engine Version 3.1 Update -
Cisco ≫ Identity Services Engine Version 3.1 Update patch1
Cisco ≫ Identity Services Engine Version 3.1 Update patch3
Cisco ≫ Identity Services Engine Version 3.1 Update patch4
Cisco ≫ Identity Services Engine Version 3.2 Update -
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.61% 0.443
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 5.4 2.8 2.5
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Cisco PSIRT 4.3 2.8 1.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CWE-648 Incorrect Use of Privileged APIs

The product does not conform to the API requirements for a function call that requires extra privileges. This could allow attackers to gain privileges by causing the function to be called incorrectly.

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-7Q4TNYUx
Vendor Advisory