Improper access control in Cisco Identity Services Engine (ISE)

1) Improper access control

EUVDB-ID: #VU68960

Risk: Medium

CVSSv3.1: 6.2 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-20956

CWE-ID: CWE-284 - Improper Access Control

Exploit availability: No

Description

The vulnerability allows a remote user to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions in the web-based management interface of an affected device. A remote user can bypass implemented security restrictions and gain list, download, and delete certain files that they should not have access to.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Cisco Identity Services Engine (ISE): 3.1 - 3.2P1

External links

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-access-contol-EeufSUCx
http://bst.cloudapps.cisco.com/bugsearch/bug/CSCwc62419

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.