Lucene search

CiscoCVE-2019-1659

HistoryFeb 21, 2019 - 3:29 p.m.

CVE-2019-1659

2019-02-2115:29:00

CWE-295

cisco

web.nvd.nist.gov

cve-2019-1659

identity services engine

ise

cisco prime infrastructure

ssl

man-in-the-middle attack

server ssl certificate validation

CVSS2

5.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:P/A:N

CVSS3

7.4

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

AI Score

7.1

Confidence

High

EPSS

0.001

Percentile

49.4%

JSON

A vulnerability in the Identity Services Engine (ISE) integration feature of Cisco Prime Infrastructure (PI) could allow an unauthenticated, remote attacker to perform a man-in-the-middle attack against the Secure Sockets Layer (SSL) tunnel established between ISE and PI. The vulnerability is due to improper validation of the server SSL certificate when establishing the SSL tunnel with ISE. An attacker could exploit this vulnerability by using a crafted SSL certificate and could then intercept communications between the ISE and PI. A successful exploit could allow the attacker to view and alter potentially sensitive information that the ISE maintains about clients that are connected to the network. This vulnerability affects Cisco Prime Infrastructure Software Releases 2.2 through 3.4.0 when the PI server is integrated with ISE, which is disabled by default.

Affected configurations

Nvd

Node

ciscoprime_infrastructureRange2.2–3.4.0

VendorProductVersionCPE
ciscoprime_infrastructure*cpe:2.3:a:cisco:prime_infrastructure:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
cisco	prime_infrastructure	*	cpe:2.3:a:cisco:prime_infrastructure::::::::

CNA Affected

[
  {
    "product": "Cisco Prime Infrastructure",
    "vendor": "Cisco",
    "versions": [
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "next of 2.2",
        "versionType": "custom"
      },
      {
        "lessThan": "3.5",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

www.securityfocus.com/bid/107092

tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190220-prime-validation

CVSS2

5.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:P/A:N

CVSS3

7.4

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

AI Score

7.1

Confidence

High

EPSS

0.001

Percentile

49.4%

JSON

Related for CVE-2019-1659