CVE-2023-20171

Multiple vulnerabilities in Cisco Identity Services Engine (ISE) could allow an authenticated attacker to delete or read arbitrary files on the underlying operating system. To exploit these vulnerabilities, an attacker must have valid credentials on an affected device. For more information about these vulnerabilities, see the Details section of this advisory.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-file-delete-read-PK5ghDDd	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:cisco:identity_services_engine:3.1:-::::::
	cpe:2.3:a:cisco:identity_services_engine:3.1:patch1::::::
	cpe:2.3:a:cisco:identity_services_engine:3.1:patch3::::::
	cpe:2.3:a:cisco:identity_services_engine:3.1:patch4::::::
	cpe:2.3:a:cisco:identity_services_engine:3.1:patch5::::::
	cpe:2.3:a:cisco:identity_services_engine:3.2:-::::::
	cpe:2.3:a:cisco:identity_services_engine:3.2:patch1::::::

History

No history.

Information

Published : 2023-05-18 03:15

Updated : 2023-11-07 04:06

NVD link : CVE-2023-20171

Mitre link : CVE-2023-20171

CVE.ORG link : CVE-2023-20171

JSON object : View

Products Affected

cisco

identity_services_engine

CWE

CWE-20

Improper Input Validation

CWE-602

Client-Side Enforcement of Server-Side Security

{"id": "CVE-2023-20171", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "ykramarz@cisco.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.8}]}, "published": "2023-05-18T03:15:10.763", "references": [{"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-file-delete-read-PK5ghDDd", "tags": ["Vendor Advisory"], "source": "ykramarz@cisco.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-20"}]}, {"type": "Secondary", "source": "ykramarz@cisco.com", "description": [{"lang": "en", "value": "CWE-602"}]}], "descriptions": [{"lang": "en", "value": "Multiple vulnerabilities in Cisco Identity Services Engine (ISE) could allow an authenticated attacker to delete or read arbitrary files on the underlying operating system. To exploit these vulnerabilities, an attacker must have valid credentials on an affected device. For more information about these vulnerabilities, see the Details section of this advisory."}], "lastModified": "2023-11-07T04:06:22.560", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cisco:identity_services_engine:3.1:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C4DB9726-532F-45CE-81FD-45F2F6C7CE51"}, {"criteria": "cpe:2.3:a:cisco:identity_services_engine:3.1:patch1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2E8F0066-0EC0-41FD-80BE-55C4ED5F6B0E"}, {"criteria": "cpe:2.3:a:cisco:identity_services_engine:3.1:patch3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5D1765DB-1BEF-4CE9-8B86-B91F709600EB"}, {"criteria": "cpe:2.3:a:cisco:identity_services_engine:3.1:patch4:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3D1E80EF-C3FD-4F7A-B63D-0EAA5C878B11"}, {"criteria": "cpe:2.3:a:cisco:identity_services_engine:3.1:patch5:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "095F27EC-5713-4D4F-AD06-57D3DF068B90"}, {"criteria": "cpe:2.3:a:cisco:identity_services_engine:3.2:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "36722B6C-64A5-4D00-94E1-442878C37A35"}, {"criteria": "cpe:2.3:a:cisco:identity_services_engine:3.2:patch1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7EEEA06A-AD58-48D3-8975-B21A961985B3"}], "operator": "OR"}]}], "sourceIdentifier": "ykramarz@cisco.com"}