Skip to content
OpenAdvisories
Medium WID-SEC-2023-1243 11 CVEs

Cisco Identity Services Engine (ISE): Mehrere Schwachstellen

Published May 18, 2023 · Updated May 18, 2023 · de-DE

Vendor: Cisco Product: Identity Services Engine (ISE) Product: Identity Services Engine (ISE) < 3.0P8 Product: Identity Services Engine (ISE) < 3.1P6 Product: Identity Services Engine (ISE) < 3.1P7 Product: Identity Services Engine (ISE) < 3.1P8 Product: Identity Services Engine (ISE) < 3.2P1 Product: Identity Services Engine (ISE) < 3.2P2

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Cisco Identity Services Engine (ISE) ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode auszuführen, Informationen offenzulegen oder Dateien zu manipulieren.

Product

Die Cisco Identity Services Engine (ISE) bietet eine attributbasierte Zugangs-Kontroll-Lösung.

Vulnerabilities 11

  • Medium 6.5
    CVE-2023-20163

    Cisco Identity Services Engine Command Injection Vulnerabilities

    Multiple vulnerabilities in Cisco Identity Services Engine (ISE) could allow an authenticated attacker to perform command injection attacks on the underlying operating system and elevate privileges to root. To exploit these vulnerabilities, an attacker must h…

    Cisco Cisco Identity Services Engine Software Network devices
  • Medium 6.5
    CVE-2023-20164

    Cisco Identity Services Engine Command Injection Vulnerabilities

    Multiple vulnerabilities in Cisco Identity Services Engine (ISE) could allow an authenticated attacker to perform command injection attacks on the underlying operating system and elevate privileges to root. To exploit these vulnerabilities, an attacker must h…

    Cisco Cisco Identity Services Engine Software Network devices
  • Medium 6.0
    CVE-2023-20166

    Cisco Identity Services Engine Path Traversal Vulnerabilities

    Multiple vulnerabilities in Cisco Identity Services Engine (ISE) could allow an authenticated attacker to perform path traversal attacks on the underlying operating system to either elevate privileges to root or read arbitrary files. To exploit these vulnerab…

    Cisco Cisco Identity Services Engine Software Network devices
  • Medium 6.0
    CVE-2023-20167

    Cisco Identity Services Engine Path Traversal Vulnerabilities

    Multiple vulnerabilities in Cisco Identity Services Engine (ISE) could allow an authenticated attacker to perform path traversal attacks on the underlying operating system to either elevate privileges to root or read arbitrary files. To exploit these vulnerab…

    Cisco Cisco Identity Services Engine Software Network devices
  • Medium 5.4
    CVE-2023-20106

    Cisco Identity Services Engine Arbitrary File Delete and File Read Vulnerabilities

    Multiple vulnerabilities in Cisco Identity Services Engine (ISE) could allow an authenticated attacker to delete or read arbitrary files on the underlying operating system. To exploit these vulnerabilities, an attacker must have valid credentials on an affect…

    Cisco Cisco Identity Services Engine Software Network devices
  • Medium 5.4
    CVE-2023-20171

    Cisco Identity Services Engine Arbitrary File Delete and File Read Vulnerabilities

    Multiple vulnerabilities in Cisco Identity Services Engine (ISE) could allow an authenticated attacker to delete or read arbitrary files on the underlying operating system. To exploit these vulnerabilities, an attacker must have valid credentials on an affect…

    Cisco Cisco Identity Services Engine Software Network devices
  • Medium 5.4
    CVE-2023-20172

    Cisco Identity Services Engine Arbitrary File Delete and File Read Vulnerabilities

    Multiple vulnerabilities in Cisco Identity Services Engine (ISE) could allow an authenticated attacker to delete or read arbitrary files on the underlying operating system. To exploit these vulnerabilities, an attacker must have valid credentials on an affect…

    Cisco Cisco Identity Services Engine Software Network devices
  • Medium 4.9
    CVE-2023-20077

    Cisco Identity Services Engine Arbitrary File Download Vulnerabilities

    Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to download arbitrary files from the filesystem of an affected device. These vulnerabilities are due to insuff…

    Cisco Cisco Identity Services Engine Software Network devices
  • Medium 4.9
    CVE-2023-20087

    Cisco Identity Services Engine Arbitrary File Download Vulnerabilities

    Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to download arbitrary files from the filesystem of an affected device. These vulnerabilities are due to insuff…

    Cisco Cisco Identity Services Engine Software Network devices
  • Medium 4.9
    CVE-2023-20173

    Cisco Identity Services Engine XML External Entity Injection Vulnerabilities

    Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to read arbitrary files or conduct a server-side request forgery (SSRF) attack through an affected device. To …

    Cisco Cisco Identity Services Engine Software Network devices
  • Medium 4.9
    CVE-2023-20174

    Cisco Identity Services Engine XML External Entity Injection Vulnerabilities

    Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to read arbitrary files or conduct a server-side request forgery (SSRF) attack through an affected device. To …

    Cisco Cisco Identity Services Engine Software Network devices

Revision history

  1. #1

    Initiale Fassung

References