PT-2021-7234 · Cisco · Cisco Identity Services Engine

Published 2021-11-02 · Updated 2022-06-24 · CVE-2022-20819

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cisco Identity Services Engine (ISE) (affected versions not specified)

Description A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to obtain sensitive information from an affected device. This issue exists due to improper enforcement of administrative privilege levels for sensitive data. An attacker with read-only privileges for the web-based management interface could exploit this by browsing to a page containing sensitive data, potentially allowing them to collect sensitive system configuration information.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Privilege Management

Incorrect Privilege Assignment

Weakness Enumeration

CWE-269

CWE-266

Related Identifiers

BDU:2022-03949

CVE-2022-20819

Affected Products

Cisco Identity Services Engine

References · 6

• https://osv.dev/vulnerability/CVE-2022-20819 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-20819 · Security Note
• https://bdu.fstec.ru/vul/2022-03949 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-info-disclosure-Os6fSd6N · Vendor Advisory
• https://cybersecurity-help.cz/vdb/SB2022061616 · Note
• https://vuldb.com/?id.202143 · Note