PT-2022-3983 · Cisco · Cisco Identity Services Engine (Ise)

Filip Palian · Published 2022-08-03 · Updated 2022-08-12 · CVE-2022-20914

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cisco Identity Services Engine (ISE) Software (affected versions not specified)

Description A vulnerability in the External RESTful Services (ERS) API could allow an authenticated, remote attacker to obtain sensitive information due to excessive verbosity in a specific REST API output. An attacker could exploit this by sending a crafted HTTP request to the affected device, potentially obtaining sensitive information, including administrative credentials for an external authentication server. The attacker must have valid ERS administrative credentials to successfully exploit this vulnerability.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

CWE-549

Related Identifiers

BDU:2022-04816

CVE-2022-20914

Affected Products

Cisco Identity Services Engine (Ise)

References · 5

• https://osv.dev/vulnerability/CVE-2022-20914 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-04816 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-pwd-WH64AhQF · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-20914 · Security Note
• http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-pwd-WH64AhQF · Note