CVE-2024-20417

Опубликовано: 21 авг. 2024

Источник: nvd

CVSS3: 6.5

CVSS3: 8.1

EPSS Низкий

Описание

Multiple vulnerabilities in the REST API of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to conduct blind SQL injection attacks.

These vulnerabilities are due to insufficient validation of user-supplied input in REST API calls. An attacker could exploit these vulnerabilities by sending crafted input to an affected device. A successful exploit could allow the attacker to view or modify data on the affected device.

Ссылки

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-rest-5bPKrNtZ
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:cisco:identity_services_engine:*:*:*:*:*:*:*:*

Версия от 3.0.0 (исключая) до 3.1 (включая)

cpe:2.3:a:cisco:identity_services_engine:3.1.0:-:*:*:*:*:*:*

cpe:2.3:a:cisco:identity_services_engine:3.1.0:patch1:*:*:*:*:*:*

cpe:2.3:a:cisco:identity_services_engine:3.1.0:patch2:*:*:*:*:*:*

cpe:2.3:a:cisco:identity_services_engine:3.1.0:patch3:*:*:*:*:*:*

cpe:2.3:a:cisco:identity_services_engine:3.1.0:patch4:*:*:*:*:*:*

cpe:2.3:a:cisco:identity_services_engine:3.1.0:patch5:*:*:*:*:*:*

cpe:2.3:a:cisco:identity_services_engine:3.1.0:patch6:*:*:*:*:*:*

cpe:2.3:a:cisco:identity_services_engine:3.1.0:patch7:*:*:*:*:*:*

cpe:2.3:a:cisco:identity_services_engine:3.1.0:patch8:*:*:*:*:*:*

cpe:2.3:a:cisco:identity_services_engine:3.1.0:patch9:*:*:*:*:*:*

cpe:2.3:a:cisco:identity_services_engine:3.2.0:-:*:*:*:*:*:*

cpe:2.3:a:cisco:identity_services_engine:3.2.0:patch1:*:*:*:*:*:*

cpe:2.3:a:cisco:identity_services_engine:3.2.0:patch2:*:*:*:*:*:*

cpe:2.3:a:cisco:identity_services_engine:3.2.0:patch3:*:*:*:*:*:*

cpe:2.3:a:cisco:identity_services_engine:3.2.0:patch4:*:*:*:*:*:*

cpe:2.3:a:cisco:identity_services_engine:3.2.0:patch5:*:*:*:*:*:*

cpe:2.3:a:cisco:identity_services_engine:3.2.0:patch6:*:*:*:*:*:*

cpe:2.3:a:cisco:identity_services_engine:3.3.0:-:*:*:*:*:*:*

cpe:2.3:a:cisco:identity_services_engine:3.3.0:patch1:*:*:*:*:*:*

cpe:2.3:a:cisco:identity_services_engine:3.3.0:patch2:*:*:*:*:*:*

cpe:2.3:a:cisco:identity_services_engine:3.3.0:patch3:*:*:*:*:*:*

EPSS

Процентиль: 40%

0.00185

Низкий

6.5 Medium

CVSS3

8.1 High

CVSS3

Дефекты

CWE-89

Связанные уязвимости

GHSA-jhcm-h49j-fwww

CVSS3: 6.5

github

больше 1 года назад

Multiple vulnerabilities in the REST API of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to conduct blind SQL injection attacks. These vulnerabilities are due to insufficient validation of user-supplied input in REST API calls. An attacker could exploit these vulnerabilities by sending crafted input to an affected device. A successful exploit could allow the attacker to view or modify data on the affected device.

BDU:2024-07023

CVSS3: 6.5

fstec

больше 2 лет назад

Уязвимость реализации прикладного программного интерфейса платформы управления политиками соединений Cisco Identity Services Engine (ISE), позволяющая нарушителю получить несанкционированный доступ на чтение и изменение защищаемой информации

EPSS

Процентиль: 40%

0.00185

Низкий

6.5 Medium

CVSS3

8.1 High

CVSS3

Дефекты

CWE-89