Lucene search

CiscoCVE-2024-20332

HistoryApr 03, 2024 - 5:15 p.m.

CVE-2024-20332

2024-04-0317:15:48

CWE-918

cisco

web.nvd.nist.gov

cisco identity services engine

web-based management

ssrf attack

input validation

http requests

network requests

super admin credentials

cve-2024-20332

nvd

CVSS3

5.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N

AI Score

6.9

Confidence

High

EPSS

Percentile

9.0%

JSON

A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to conduct a server-side request forgery (SSRF) attack through an affected device.

This vulnerability is due to improper input validation for specific HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to send arbitrary network requests that are sourced from the affected device. To successfully exploit this vulnerability, the attacker would need valid Super Admin credentials.

Affected configurations

Vulners

Node

ciscoidentity_services_engine_softwareMatch3.2.0

ciscoidentity_services_engine_softwareMatch3.3.0

VendorProductVersionCPE
ciscoidentity_services_engine_software3.2.0cpe:2.3:a:cisco:identity_services_engine_software:3.2.0:*:*:*:*:*:*:*
ciscoidentity_services_engine_software3.3.0cpe:2.3:a:cisco:identity_services_engine_software:3.3.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
cisco	identity_services_engine_software	3.2.0	cpe:2.3:a:cisco:identity_services_engine_software:3.2.0:::::::*
cisco	identity_services_engine_software	3.3.0	cpe:2.3:a:cisco:identity_services_engine_software:3.3.0:::::::*

CNA Affected

[
  {
    "vendor": "Cisco",
    "product": "Cisco Identity Services Engine Software",
    "versions": [
      {
        "version": "3.2.0",
        "status": "affected"
      },
      {
        "version": "3.2.0 p1",
        "status": "affected"
      },
      {
        "version": "3.2.0 p2",
        "status": "affected"
      },
      {
        "version": "3.2.0 p3",
        "status": "affected"
      },
      {
        "version": "3.2.0 p4",
        "status": "affected"
      },
      {
        "version": "3.3.0",
        "status": "affected"
      }
    ]
  }
]

References

sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-ssrf-FtSTh5Oz

CVSS3

5.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N

AI Score

6.9

Confidence

High

EPSS

Percentile

9.0%

JSON

Related for CVE-2024-20332