PT-2023-2801 · Cisco · Cisco Identity Services Engine

Arthur Vidineyev · Publicado 2023-05-17 · Atualizado 2023-05-26 · CVE-2023-20167

Positive Technologies (AI Summary)

CVSS v2.0

6.1

Média

Vetor base

AV:N/AC:L/Au:M/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cisco Identity Services Engine (ISE) (affected versions not specified)

Description The issue is related to deficiencies in directory path checking, allowing an attacker to perform path traversal attacks on the underlying operating system. This could enable an attacker to either elevate privileges to root or read arbitrary files. To exploit this, an attacker must have valid Administrator credentials on the affected device.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Enumeração de Fraquezas

CWE-24

CWE-22

Identificadores relacionados

BDU:2023-02719

CVE-2023-20167

Produtos afetados

Cisco Identity Services Engine

Referências · 7

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-traversal-ZTUgMYhu · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-20167 · Nota de Segurança
• https://cybersecurity-help.cz/vdb/SB2023051842 · Nota
• https://bdu.fstec.ru/vul/2023-02719 · Nota de Segurança
• https://t.me/cibsecurity/64374 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-20167 · Aviso do Fabricante
• https://t.me/cvenotify/50709 · Publicação no Telegram