Description
The RBAC implementation in Cisco Identity Services Engine (ISE) Software does not properly verify privileges for support-bundle downloads, which allows remote authenticated users to obtain sensitive information via a download action, as demonstrated by obtaining read access to the user database, aka Bug ID CSCul83904.
References
- cisco-ise-cve2040665-unsuth-access(90463) vdb-entry
- 102118 vdb-entry
- http://tools.cisco.com/security/center/viewAlert.x?alertId=32448
- 1029624 vdb-entry
- 56439 third-party-advisory
- 64939 vdb-entry
- 20140115 Cisco ISE Unprivileged Support Bundle Download Vulnerability vendor-advisory