CVE-2020-3467 — Incorrect Authorization in Cisco Identity Services Engine

CWE-863 — Incorrect Authorization4 documents4 sources
Severity
7.7HIGHNVD
EPSS
0.1%
top 67.89%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Cisco Identity Services EngineCisco Identity Services Engine Software
Timeline
PublishedOct 8
Latest updateMay 24

Description

A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to modify parts of the configuration on an affected device. The vulnerability is due to improper enforcement of role-based access control (RBAC) within the web-based management interface. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to modify parts of the c…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:HExploitability: 3.1 | Impact: 4.0

Affected Packages2 packages

🔴Vulnerability Details

2
GHSA
GHSA-q24x-ghr8-3342: A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to modify↗2022-05-24
▶
CVEList
Cisco Identity Services Engine Authorization Bypass Vulnerability↗2020-10-08
▶

📋Vendor Advisories

1
Cisco
Cisco Identity Services Engine Authorization Bypass Vulnerability↗2020-10-07
▶
CVE-2020-3467 — Incorrect Authorization in Cisco | cvebase