4.9

CVE-2024-20466

Cisco Identity Services Engine Sensitive Information Disclosure Vulnerability

A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to obtain sensitive information from an affected device. 

This vulnerability is due to improper enforcement of administrative privilege levels for high-value sensitive data. An attacker with read-only Administrator privileges for the web-based management interface on an affected device could exploit this vulnerability by browsing to a page that contains sensitive data. A successful exploit could allow the attacker to collect sensitive information regarding the configuration of the system.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Cisco ≫ Identity Services Engine Version >= 2.7.0 < 3.1
Cisco ≫ Identity Services Engine Version 3.1.0 Update -
Cisco ≫ Identity Services Engine Version 3.1.0 Update patch1
Cisco ≫ Identity Services Engine Version 3.1.0 Update patch2
Cisco ≫ Identity Services Engine Version 3.1.0 Update patch3
Cisco ≫ Identity Services Engine Version 3.1.0 Update patch4
Cisco ≫ Identity Services Engine Version 3.1.0 Update patch5
Cisco ≫ Identity Services Engine Version 3.1.0 Update patch6
Cisco ≫ Identity Services Engine Version 3.1.0 Update patch7
Cisco ≫ Identity Services Engine Version 3.1.0 Update patch8
Cisco ≫ Identity Services Engine Version 3.1.0 Update patch9
Cisco ≫ Identity Services Engine Version 3.2.0 Update -
Cisco ≫ Identity Services Engine Version 3.2.0 Update patch1
Cisco ≫ Identity Services Engine Version 3.2.0 Update patch2
Cisco ≫ Identity Services Engine Version 3.2.0 Update patch3
Cisco ≫ Identity Services Engine Version 3.2.0 Update patch4
Cisco ≫ Identity Services Engine Version 3.3.0 Update -
Cisco ≫ Identity Services Engine Version 3.3.0 Update patch1
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.48% 0.374
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 4.9 1.2 3.6
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Cisco PSIRT 6.5 2.8 3.6
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CWE-266 Incorrect Privilege Assignment

A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.

CWE-863 Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-info-exp-vdF8Jbyk
Vendor Advisory