PT-2022-5481 · Cisco · Cisco Identity Services Engine

Antonio López + 1 · Published 2022-11-02 · Updated 2024-01-25 · CVE-2022-20962

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco Identity Services Engine (ISE) (affected versions not specified)

Description A vulnerability in the Localdisk Management feature could allow an authenticated, remote attacker to make unauthorized changes to the file system of an affected device. This issue is due to insufficient input validation, allowing an attacker to exploit it by sending a crafted HTTP request with absolute path sequences. A successful exploit could allow the attacker to upload malicious files to arbitrary locations within the file system, potentially accessing the underlying operating system and executing commands with system privileges.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Weakness Enumeration

CWE-37

CWE-22

Related Identifiers

BDU:2022-06810

CVE-2022-20962

Affected Products

Cisco Identity Services Engine

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2022-20962 · Security Note
• https://osv.dev/vulnerability/CVE-2022-20962 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-06810 · Security Note
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-path-trav-f6M7cs6r · Vendor Advisory
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-path-trav-f6M7cs6r · Note