Skip to content
OpenAdvisories
Medium WID-SEC-2023-0253 4 CVEs

Cisco Identity Services Engine (ISE): Mehrere Schwachstellen

Published Feb 1, 2023 · Updated Feb 1, 2023 · de-DE

Vendor: Cisco Product: Identity Services Engine (ISE) 3.2 < 3.2P1

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Cisco Identity Services Engine (ISE) ausnutzen, um seine Privilegien zu erhöhen, Dateien zu manipulieren oder Informationen offenzulegen.

Product

Die Cisco Identity Services Engine (ISE) bietet eine attributbasierte Zugangs-Kontroll-Lösung.

Vulnerabilities 4

  • Medium 6.0
    CVE-2023-20021

    Cisco Identity Services Engine Privilege Escalation Vulnerabilities

    Multiple vulnerabilities in specific Cisco Identity Services Engine (ISE) CLI commands could allow an authenticated, local attacker to perform command injection attacks on the underlying operating system and elevate privileges to root. To exploit these vulner…

    Cisco Cisco Identity Services Engine Software Network devices
  • Medium 6.0
    CVE-2023-20022

    Cisco Identity Services Engine Privilege Escalation Vulnerabilities

    Multiple vulnerabilities in specific Cisco Identity Services Engine (ISE) CLI commands could allow an authenticated, local attacker to perform command injection attacks on the underlying operating system and elevate privileges to root. To exploit these vulner…

    Cisco Cisco Identity Services Engine Software Network devices
  • Medium 6.0
    CVE-2023-20023

    Cisco Identity Services Engine Privilege Escalation Vulnerabilities

    Multiple vulnerabilities in specific Cisco Identity Services Engine (ISE) CLI commands could allow an authenticated, local attacker to perform command injection attacks on the underlying operating system and elevate privileges to root. To exploit these vulner…

    Cisco Cisco Identity Services Engine Software Network devices
  • Medium 6.0
    CVE-2023-20030

    Cisco Identity Services Engine XML External Entity Injection Vulnerability

    A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to access sensitive information, conduct a server-side request forgery (SSRF) attack through an affected device, or neg…

    Cisco Cisco Identity Services Engine Software Network devices

Revision history

  1. #1

    Initiale Fassung

References