Cisco Identity Services Engine Software 2.7.0 p8 up to 3.3.0 Web-based Management Interface missing encryption

Summaryinfo

A vulnerability categorized as problematic has been discovered in Cisco Identity Services Engine Software. This vulnerability affects unknown code of the component Web-based Management Interface. The manipulation results in missing encryption. This vulnerability is cataloged as CVE-2024-20515. The attack may be launched remotely. There is no exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, was found in Cisco Identity Services Engine Software. Affected is an unknown functionality of the component Web-based Management Interface. The manipulation with an unknown input leads to a missing encryption vulnerability. CWE is classifying the issue as CWE-311. The product does not encrypt sensitive or critical information before storage or transmission. This is going to have an impact on confidentiality. CVE summarizes:

A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to obtain sensitive information from an affected device. This vulnerability is due to a lack of proper data protection mechanisms for certain configuration settings. An attacker with Read-Only Administrator privileges could exploit this vulnerability by browsing to a page that contains sensitive data. A successful exploit could allow the attacker to view device credentials that are normally not visible to Read-Only Administrators.

The advisory is shared for download at sec.cloudapps.cisco.com. This vulnerability is traded as CVE-2024-20515 since 11/08/2023. The exploitability is told to be easy. It is possible to launch the attack remotely. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1600.

The vulnerability scanner Nessus provides a plugin with the ID 208078 (Cisco Identity Services Engine Information Disclosure (cisco-sa-ise-info-disc-ZYF2nEEX)), which helps to determine the existence of the flaw in a target environment.

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (208078). Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Policy Management Software

Vendor

• Cisco

Name

• Identity Services Engine Software

Version

• 2.7.0 p8
• 3.0.0
• 3.0.0 p1
• 3.0.0 p2
• 3.0.0 p3
• 3.0.0 p4
• 3.0.0 p5
• 3.0.0 p6
• 3.0.0 p7
• 3.0.0 p8
• 3.1.0
• 3.1.0 p1
• 3.1.0 p2
• 3.1.0 p3
• 3.1.0 p4
• 3.1.0 p5
• 3.1.0 p6
• 3.1.0 p7
• 3.1.0 p8
• 3.2.0
• 3.2.0 p1
• 3.2.0 p2
• 3.2.0 p3
• 3.2.0 p4
• 3.2.0 p5
• 3.2.0 p6
• 3.3 Patch 1
• 3.3 Patch 2
• 3.3 Patch 3
• 3.3.0
• 3.4.0

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion