SB2017080302 - Authentication bypass in Cisco Identity Services Engine
Published: August 3, 2017
Security Bulletin ID
SB2017080302
Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Code execution
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Authentication bypass (CVE-ID: CVE-2017-6747)
The vulnerability allows a remote unauthenticated attacker to bypass local authentication.The weakness exists due to improper handling of authentication requests and policy assignment for externally authenticated users. A remote attacker can authenticate with a valid external user account that matches an internal username, bypass authentication restrictions and gain Super Admin privileges for the ISE Admin portal.
Successful exploitation of the vulnerability results in unauthorized access to the system.
Remediation
Install update from vendor's website.