PT-2023-7110 · Cisco · Cisco Identity Services Engine

Cristian Mocanu + 1 · Publicado 2023-11-15 · Atualizado 2024-01-25 · CVE-2023-20272

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cisco Identity Services Engine (affected versions not specified)

Description The issue is related to insufficient file input validation in the web-based management interface, allowing an authenticated, remote attacker to upload malicious files to the web root of the application. This could enable the attacker to replace files and gain access to sensitive server-side information. The vulnerability can be exploited by uploading a malicious file to the web interface.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Enumeração de Fraquezas

CWE-424

CWE-20

Identificadores relacionados

BDU:2023-08137

CVE-2023-20272

Produtos afetados

Cisco Identity Services Engine

Referências · 5

• https://vuldb.com/ru/?id.245518 · Nota
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-mult-j-KxpNynR · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-20272 · Nota de Segurança
• https://bdu.fstec.ru/vul/2023-08137 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-20272 · Aviso do Fabricante