Cisco Identity Services Engine Software up to 3.3.0 Web-based Management Interface privileges assignment

Summaryinfo

A vulnerability, which was classified as problematic, was found in Cisco Identity Services Engine Software. The impacted element is an unknown function of the component Web-based Management Interface. Such manipulation leads to privileges assignment. This vulnerability is referenced as CVE-2024-20466. It is possible to launch the attack remotely. No exploit is available. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in Cisco Identity Services Engine Software. It has been rated as problematic. Affected by this issue is some unknown functionality of the component Web-based Management Interface. The manipulation with an unknown input leads to a privileges assignment vulnerability. Using CWE to declare the problem leads to CWE-266. A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor. Impacted is confidentiality. CVE summarizes:

A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to obtain sensitive information from an affected device. This vulnerability is due to improper enforcement of administrative privilege levels for high-value sensitive data. An attacker with read-only Administrator privileges for the web-based management interface on an affected device could exploit this vulnerability by browsing to a page that contains sensitive data. A successful exploit could allow the attacker to collect sensitive information regarding the configuration of the system.

The advisory is shared for download at sec.cloudapps.cisco.com. This vulnerability is handled as CVE-2024-20466 since 11/08/2023. The exploitation is known to be easy. The attack may be launched remotely. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 04/01/2025). The MITRE ATT&CK project declares the attack technique as T1068.

The vulnerability scanner Nessus provides a plugin with the ID 208142 (Cisco Identity Services Engine Sensitive Information Disclosure (cisco-sa-ise-info-exp-vdF8Jbyk)), which helps to determine the existence of the flaw in a target environment.

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (208142). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Policy Management Software

Vendor

• Cisco

Name

• Identity Services Engine Software

Version

• 2.7.0
• 2.7.0 p1
• 2.7.0 p2
• 2.7.0 p3
• 2.7.0 p4
• 2.7.0 p5
• 2.7.0 p6
• 2.7.0 p7
• 2.7.0 p8
• 2.7.0 p9
• 2.7.0 p10
• 3.0.0
• 3.0.0 p1
• 3.0.0 p2
• 3.0.0 p3
• 3.0.0 p4
• 3.0.0 p5
• 3.0.0 p6
• 3.0.0 p7
• 3.0.0 p8
• 3.1.0
• 3.1.0 p1
• 3.1.0 p2
• 3.1.0 p3
• 3.1.0 p4
• 3.1.0 p5
• 3.1.0 p6
• 3.1.0 p7
• 3.1.0 p8
• 3.1.0 p9
• 3.2.0
• 3.2.0 p1
• 3.2.0 p2
• 3.2.0 p3
• 3.2.0 p4
• 3.3 Patch 1
• 3.3.0

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion