Cisco Identity Services Engine Software 2.7.0 p8 up to 3.3 Patch 3 Web-based Management Interface client-side enforcement of server-side security

Summaryinfo

A vulnerability was found in Cisco Identity Services Engine Software. It has been classified as problematic. This affects an unknown part of the component Web-based Management Interface. This manipulation causes client-side enforcement of server-side security. This vulnerability is handled as CVE-2024-20476. The attack can be initiated remotely. There is not any exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability has been found in Cisco Identity Services Engine Software and classified as problematic. Affected by this vulnerability is an unknown code block of the component Web-based Management Interface. The manipulation with an unknown input leads to a client-side enforcement of server-side security vulnerability. The CWE definition for the vulnerability is CWE-602. The product is composed of a server that relies on the client to implement a mechanism that is intended to protect the server. As an impact it is known to affect integrity. The summary by CVE is:

A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to bypass the authorization mechanisms for specific file management functions. This vulnerability is due to lack of server-side validation of Administrator permissions. An attacker could exploit this vulnerability by submitting a crafted HTTP request to an affected system. A successful exploit could allow the attacker to upload files to a location that should be restricted. To exploit this vulnerability, an attacker would need valid Read-Only Administrator credentials.

It is possible to read the advisory at sec.cloudapps.cisco.com. This vulnerability is known as CVE-2024-20476 since 11/08/2023. The exploitation appears to be easy. The attack can be launched remotely. The exploitation needs additional levels of successful authentication. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 04/05/2025).

The vulnerability scanner Nessus provides a plugin with the ID 210628 (Cisco Identity Services Engine Vulnerabilities (cisco-sa-ise-multi-vulns-AF544ED5)), which helps to determine the existence of the flaw in a target environment.

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (210628). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Policy Management Software

Vendor

• Cisco

Name

• Identity Services Engine Software

Version

• 2.7.0 p8
• 3.0.0
• 3.0.0 p1
• 3.0.0 p2
• 3.0.0 p3
• 3.0.0 p4
• 3.0.0 p5
• 3.0.0 p6
• 3.0.0 p7
• 3.0.0 p8
• 3.1.0
• 3.1.0 p1
• 3.1.0 p2
• 3.1.0 p3
• 3.1.0 p4
• 3.1.0 p5
• 3.1.0 p6
• 3.1.0 p7
• 3.1.0 p8
• 3.1.0 p9
• 3.2.0
• 3.2.0 p1
• 3.2.0 p2
• 3.2.0 p3
• 3.2.0 p4
• 3.2.0 p5
• 3.2.0 p6
• 3.3 Patch 1
• 3.3 Patch 2
• 3.3 Patch 3
• 3.3.0

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion