PT-2023-7110 · Cisco · Cisco Identity Services Engine

Cristian Mocanu + 1 · Published 2023-11-15 · Updated 2024-01-25 · CVE-2023-20272

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cisco Identity Services Engine (affected versions not specified)

Description The issue is related to insufficient file input validation in the web-based management interface, allowing an authenticated, remote attacker to upload malicious files to the web root of the application. This could enable the attacker to replace files and gain access to sensitive server-side information. The vulnerability can be exploited by uploading a malicious file to the web interface.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-424

CWE-20

Related Identifiers

BDU:2023-08137

CVE-2023-20272

Affected Products

Cisco Identity Services Engine

References · 5

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-mult-j-KxpNynR · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-20272 · Security Note
• https://bdu.fstec.ru/vul/2023-08137 · Security Note
• https://osv.dev/vulnerability/CVE-2023-20272 · Vendor Advisory
• https://vuldb.com/ru/?id.245518 · Note