PT-2018-8676 · Cisco · Cisco Identity Services Engine

Publicado 2018-03-08 · Atualizado 2020-09-04 · CVE-2018-0214

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions: Cisco Identity Services Engine (ISE) (affected versions not specified)

Description: A command injection issue exists due to insufficient input validation of CLI command user input, allowing an authenticated, local attacker to execute arbitrary commands on the host operating system with the privileges of the local user. The attacker must have valid user credentials for the device and could exploit this by issuing a CLI command with crafted user input.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

RCE

Enumeração de Fraquezas

CWE-78

CWE-20

Identificadores relacionados

CVE-2018-0214

Produtos afetados

Cisco Identity Services Engine

Referências · 5

• http://securityfocus.com/bid/103331 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-0214 · Nota de Segurança
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180307-ise3 · Aviso do Fabricante
• http://securitytracker.com/id/1040471 · Nota
• https://osv.dev/vulnerability/CVE-2018-0214 · Aviso do Fabricante