Cisco Identity Services Engine Portal Privilege Elevation Vulnerability

A vulnerability in the Sponsor Portal of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to access guest accounts created from another sponsor account.

The vulnerability is due to a failure to restrict guest accounts across sponsors. An attacker could exploit this vulnerability by manipulating an HTTP request prior to submission to the ISE portal. A successful exploit could allow the attacker to access or modify the login and account details of a guest account created by another sponsor.

Cisco has confirmed the vulnerability; however, software updates are not available.

To exploit this vulnerability, an attacker must authenticate to the targeted system. This access requirement decreases the likelihood of a successful exploit.

Cisco indicates through the CVSS score that functional exploit code exists; however, the code is not known to be publicly available.