Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

nvd логотип

CVE-2019-15282

Опубликовано: 16 окт. 2019
Источник: nvd
CVSS3: 4.3
CVSS3: 5.3
CVSS2: 5
EPSS Низкий

Описание

A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) Software could allow an unauthenticated, remote attacker read tcpdump files generated on an affected device. The vulnerability is due an issue in the authentication logic of the web-based management interface. An attacker could exploit this vulnerability by sending a crafted request to the web interface. A successful exploit could allow the attacker to read a tcpdump file generated with a particular naming scheme.

Ссылки

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:cisco:identity_services_engine_software:*:*:*:*:*:*:*:*
Версия до 2.4\(0.357\) (исключая)
cpe:2.3:a:cisco:identity_services_engine_software:2.4\(0.357\):-:*:*:*:*:*:*
cpe:2.3:a:cisco:identity_services_engine_software:2.4\(0.357\):patch1:*:*:*:*:*:*
cpe:2.3:a:cisco:identity_services_engine_software:2.4\(0.357\):patch2:*:*:*:*:*:*
cpe:2.3:a:cisco:identity_services_engine_software:2.4\(0.357\):patch3:*:*:*:*:*:*
cpe:2.3:a:cisco:identity_services_engine_software:2.4\(0.357\):patch4:*:*:*:*:*:*
cpe:2.3:a:cisco:identity_services_engine_software:2.4\(0.357\):patch5:*:*:*:*:*:*
cpe:2.3:a:cisco:identity_services_engine_software:2.4\(0.357\):patch6:*:*:*:*:*:*
cpe:2.3:a:cisco:identity_services_engine_software:2.4\(0.357\):patch7:*:*:*:*:*:*
cpe:2.3:a:cisco:identity_services_engine_software:2.4\(0.357\):patch8:*:*:*:*:*:*
cpe:2.3:a:cisco:identity_services_engine_software:2.4\(0.357\):patch9:*:*:*:*:*:*

EPSS

Процентиль: 78%
0.01094
Низкий

4.3 Medium

CVSS3

5.3 Medium

CVSS3

5 Medium

CVSS2

Дефекты

CWE-306
CWE-306

Связанные уязвимости

github логотип

GHSA-gh78-6hq3-f87p

CVSS3: 5.3
github
больше 3 лет назад

A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) Software could allow an unauthenticated, remote attacker read tcpdump files generated on an affected device. The vulnerability is due an issue in the authentication logic of the web-based management interface. An attacker could exploit this vulnerability by sending a crafted request to the web interface. A successful exploit could allow the attacker to read a tcpdump file generated with a particular naming scheme.

fstec логотип

BDU:2019-04420

CVSS3: 4.3
fstec
больше 6 лет назад

Уязвимость веб-интерфейса платформы управления политиками соединений Cisco Identity Services Engine (ISE), позволяющая нарушителю получить несанкционированный доступ к защищаемой информации

EPSS

Процентиль: 78%
0.01094
Низкий

4.3 Medium

CVSS3

5.3 Medium

CVSS3

5 Medium

CVSS2

Дефекты

CWE-306
CWE-306