5.4

CVE-2022-20965

A vulnerability in the web-based management interface of Cisco Identity Services Engine could allow an authenticated, remote attacker to take privileges actions within the web-based management interface.

 This vulnerability is due to improper access control on a feature within the web-based management interface of the affected system. An attacker could exploit this vulnerability by accessing features through direct requests, bypassing checks within the application. A successful exploit could allow the attacker to take privileged actions within the web-based management interface that should be otherwise restricted.

    

  {{value}} ["%7b%7bvalue%7d%7d"])}]]

Data is provided by the National Vulnerability Database (NVD)
CiscoIdentity Services Engine Version < 2.6.0
CiscoIdentity Services Engine Version2.6.0 Update-
CiscoIdentity Services Engine Version2.6.0 Updatepatch1
CiscoIdentity Services Engine Version2.6.0 Updatepatch10
CiscoIdentity Services Engine Version2.6.0 Updatepatch11
CiscoIdentity Services Engine Version2.6.0 Updatepatch12
CiscoIdentity Services Engine Version2.6.0 Updatepatch2
CiscoIdentity Services Engine Version2.6.0 Updatepatch3
CiscoIdentity Services Engine Version2.6.0 Updatepatch5
CiscoIdentity Services Engine Version2.6.0 Updatepatch6
CiscoIdentity Services Engine Version2.6.0 Updatepatch7
CiscoIdentity Services Engine Version2.6.0 Updatepatch8
CiscoIdentity Services Engine Version2.6.0 Updatepatch9
CiscoIdentity Services Engine Version2.7.0 Update-
CiscoIdentity Services Engine Version2.7.0 Updatepatch1
CiscoIdentity Services Engine Version2.7.0 Updatepatch2
CiscoIdentity Services Engine Version2.7.0 Updatepatch3
CiscoIdentity Services Engine Version2.7.0 Updatepatch4
CiscoIdentity Services Engine Version2.7.0 Updatepatch5
CiscoIdentity Services Engine Version2.7.0 Updatepatch6
CiscoIdentity Services Engine Version2.7.0 Updatepatch7
CiscoIdentity Services Engine Version3.0.0 Update-
CiscoIdentity Services Engine Version3.0.0 Updatepatch1
CiscoIdentity Services Engine Version3.0.0 Updatepatch2
CiscoIdentity Services Engine Version3.0.0 Updatepatch3
CiscoIdentity Services Engine Version3.0.0 Updatepatch4
CiscoIdentity Services Engine Version3.0.0 Updatepatch5
CiscoIdentity Services Engine Version3.0.0 Updatepatch6
CiscoIdentity Services Engine Version3.1 Update-
CiscoIdentity Services Engine Version3.1 Updatepatch1
CiscoIdentity Services Engine Version3.1 Updatepatch3
CiscoIdentity Services Engine Version3.1 Updatepatch4
CiscoIdentity Services Engine Version3.2 Update-
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.02% 0.037
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 5.4 2.8 2.5
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
psirt@cisco.com 4.3 2.8 1.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CWE-648 Incorrect Use of Privileged APIs

The product does not conform to the API requirements for a function call that requires extra privileges. This could allow attackers to gain privileges by causing the function to be called incorrectly.