PT-2018-8682 · Cisco · Cisco Identity Services Engine

Publicado 2018-03-08 · Atualizado 2019-10-09 · CVE-2018-0221

Positive Technologies (AI Summary)

CVSS v2.0

7.2

Alta

Vetor base

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Cisco Identity Services Engine (ISE) (affected versions not specified)

Description: A vulnerability exists due to incomplete input validation of user input for certain CLI ISE configuration commands, allowing an authenticated, local attacker with valid administrator credentials to perform command injection to the underlying operating system or cause a hang or disconnect of the user session. The attacker can exploit this by issuing a specific CLI command and entering crafted, malicious user input for the command parameters, potentially allowing command injection to the lower-level Linux operating system or causing the ISE user interface to hang or disconnect.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

CVE-2018-0221

Produtos afetados

Cisco Identity Services Engine

Referências · 5

• https://nvd.nist.gov/vuln/detail/CVE-2018-0221 · Nota de Segurança
• http://securityfocus.com/bid/103347 · Nota
• https://osv.dev/vulnerability/CVE-2018-0221 · Aviso do Fabricante
• http://securitytracker.com/id/1040471 · Nota
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180307-ise6 · Aviso do Fabricante