CVE-2022-20914 — Missing Password Field Masking in Cisco Identity Services Engine

CWE-549 — Missing Password Field MaskingCWE-522 — Insufficiently Protected Credentials4 documents4 sources
Severity
4.9MEDIUMNVD
EPSS
0.2%
top 63.67%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Cisco Identity Services EngineCisco Identity Services Engine Software
Timeline
PublishedAug 10
Latest updateAug 11

Description

A vulnerability in the External RESTful Services (ERS) API of Cisco Identity Services Engine (ISE) Software could allow an authenticated, remote attacker to obtain sensitive information. This vulnerability is due to excessive verbosity in a specific REST API output. An attacker could exploit this vulnerability by sending a crafted HTTP request to the affected device. A successful exploit could allow the attacker to obtain sensitive information, including administrative credentials for an externa…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:NExploitability: 1.2 | Impact: 3.6

Affected Packages2 packages

▶NVDcisco/identity_services_engine2.4.0 — 2.6.0+4

🔴Vulnerability Details

2
GHSA
GHSA-72c9-6vxw-8h9h: A vulnerability in the External RESTful Services (ERS) API of Cisco Identity Services Engine (ISE) Software could allow an authenticated, remote attac↗2022-08-11
▶
CVEList
Cisco Identity Services Engine Sensitive Information Disclosure Vulnerability↗2022-08-10
▶

📋Vendor Advisories

1
Cisco
Cisco Identity Services Engine Sensitive Information Disclosure Vulnerability↗2022-08-03
▶
CVE-2022-20914 — Missing Password Field Masking | cvebase