CVE-2022-20782

Common vulnerabilities & exposures (CVE)

CVE database CVE database blogpost Release & EoL database

Published at: - 06-04-2022 09:15

Last modified: - 14-04-2022 11:09

Total changes: - 2

Description

A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to obtain sensitive information from an affected device. This vulnerability is due to improper enforcement of administrative privilege levels for high-value sensitive data. An attacker with read-only Administrator privileges to the web-based management interface on an affected device could exploit this vulnerability by browsing to a page that contains sensitive data. A successful exploit could allow the attacker to collect sensitive information regarding the configuration of the system.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Low

Attack complexity

Network

Attack vector

None

Availability

High

Confidentiality

None

Integrity

Low

Privileges required

Unchanged

Scope

None

User interaction

6.5

Base score

2.8

3.6

Exploitability score

Impact score

Verification logic

vendor=cisco AND product=identity_services_engine AND version=2.6.0 AND update=-

vendor=cisco AND product=identity_services_engine AND version=2.6.0 AND update=patch1

vendor=cisco AND product=identity_services_engine AND version=2.6.0 AND update=patch10

vendor=cisco AND product=identity_services_engine AND version=2.6.0 AND update=patch2

vendor=cisco AND product=identity_services_engine AND version=2.6.0 AND update=patch3

vendor=cisco AND product=identity_services_engine AND version=2.6.0 AND update=patch5

vendor=cisco AND product=identity_services_engine AND version=2.6.0 AND update=patch6

vendor=cisco AND product=identity_services_engine AND version=2.6.0 AND update=patch7

vendor=cisco AND product=identity_services_engine AND version=2.6.0 AND update=patch8

vendor=cisco AND product=identity_services_engine AND version=2.6.0 AND update=patch9

vendor=cisco AND product=identity_services_engine AND version=2.7.0 AND update=-

vendor=cisco AND product=identity_services_engine AND version=2.7.0 AND update=patch1

vendor=cisco AND product=identity_services_engine AND version=2.7.0 AND update=patch2

vendor=cisco AND product=identity_services_engine AND version=2.7.0 AND update=patch3

vendor=cisco AND product=identity_services_engine AND version=2.7.0 AND update=patch4

vendor=cisco AND product=identity_services_engine AND version=2.7.0 AND update=patch5

vendor=cisco AND product=identity_services_engine AND version=2.7.0 AND update=patch6

vendor=cisco AND product=identity_services_engine AND version=3.0.0 AND update=-

vendor=cisco AND product=identity_services_engine AND version=3.0.0 AND update=patch1

vendor=cisco AND product=identity_services_engine AND version=3.0.0 AND update=patch2

vendor=cisco AND product=identity_services_engine AND version=3.0.0 AND update=patch3

vendor=cisco AND product=identity_services_engine AND version=3.0.0 AND update=patch4

vendor=cisco AND product=identity_services_engine AND version=3.1 AND update=-

Reference

20220406 Cisco Identity Services Engine Sensitive Information Disclosure Vulnerability-Vendor Advisory

Keywords

CVE-2022-20782

Common vulnerabilities & exposures (CVE)

Description

Common Vulnerability Scoring System (CVSS)

Verification logic

Reference

NVD

CVE-2022-20782

CVE

Common vulnerabilities & exposures

CVSS

Common vulnerability scoring system

Security

Vulnerabilities

Exposures