PT-2019-2210 · Cisco · Cisco Identity Services Engine

Published 2019-05-15 · Updated 2020-10-16 · CVE-2019-1851

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Cisco Identity Services Engine (ISE) (affected versions not specified)

Description A vulnerability in the External RESTful Services (ERS) API of the Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to generate arbitrary certificates signed by the Internal Certificate Authority (CA) Services on ISE. This issue is due to an incorrect implementation of role-based access control (RBAC). An attacker could exploit this by crafting a specific HTTP request with administrative credentials, allowing them to generate a certificate that is signed and trusted by the ISE CA with arbitrary attributes. This could enable the attacker to access other networks or assets protected by certificate authentication.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authorization

Weakness Enumeration

CWE-285

Related Identifiers

BDU:2019-01981

CVE-2019-1851

Affected Products

Cisco Identity Services Engine

References · 5

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-ise-certcreation · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-1851 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-1851 · Security Note
• https://bdu.fstec.ru/vul/2019-01981 · Security Note
• http://securityfocus.com/bid/108356 · Note