6.5

CVE-2024-20537

Cisco Identity Services Engine Authorization Bypass Vulnerability

A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to bypass the authorization mechanisms for specific administrative functions.

This vulnerability is due to a lack of server-side validation of Administrator permissions. An attacker could exploit this vulnerability by submitting a crafted HTTP request to an affected system. A successful exploit could allow the attacker to conduct administrative functions beyond their intended access level. To exploit this vulnerability, an attacker would need Read-Only Administrator credentials.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Cisco ≫ Identity Services Engine Version 3.0.0 Update -
Cisco ≫ Identity Services Engine Version 3.0.0 Update patch1
Cisco ≫ Identity Services Engine Version 3.0.0 Update patch2
Cisco ≫ Identity Services Engine Version 3.0.0 Update patch3
Cisco ≫ Identity Services Engine Version 3.0.0 Update patch4
Cisco ≫ Identity Services Engine Version 3.0.0 Update patch5
Cisco ≫ Identity Services Engine Version 3.0.0 Update patch6
Cisco ≫ Identity Services Engine Version 3.0.0 Update patch7
Cisco ≫ Identity Services Engine Version 3.0.0 Update patch8
Cisco ≫ Identity Services Engine Version 3.1.0 Update -
Cisco ≫ Identity Services Engine Version 3.1.0 Update patch1
Cisco ≫ Identity Services Engine Version 3.1.0 Update patch2
Cisco ≫ Identity Services Engine Version 3.1.0 Update patch3
Cisco ≫ Identity Services Engine Version 3.1.0 Update patch4
Cisco ≫ Identity Services Engine Version 3.1.0 Update patch5
Cisco ≫ Identity Services Engine Version 3.1.0 Update patch6
Cisco ≫ Identity Services Engine Version 3.1.0 Update patch7
Cisco ≫ Identity Services Engine Version 3.1.0 Update patch8
Cisco ≫ Identity Services Engine Version 3.1.0 Update patch9
Cisco ≫ Identity Services Engine Version 3.2.0 Update -
Cisco ≫ Identity Services Engine Version 3.2.0 Update patch1
Cisco ≫ Identity Services Engine Version 3.2.0 Update patch2
Cisco ≫ Identity Services Engine Version 3.2.0 Update patch3
Cisco ≫ Identity Services Engine Version 3.2.0 Update patch4
Cisco ≫ Identity Services Engine Version 3.2.0 Update patch5
Cisco ≫ Identity Services Engine Version 3.2.0 Update patch6
Cisco ≫ Identity Services Engine Version 3.3.0 Update -
Cisco ≫ Identity Services Engine Version 3.3.0 Update patch1
Cisco ≫ Identity Services Engine Version 3.3.0 Update patch2
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.46% 0.381
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 6.5 2.8 3.6
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Cisco PSIRT 6.5 2.8 3.6
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
CWE-863 Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-auth-bypass-BBRf7mkE
Vendor Advisory