CVE-2022-20962 — Path Traversal: '/absolute/pathname/here' in Cisco Identity Services Engine Software

CWE-37 — Path Traversal: '/absolute/pathname/here'CWE-22 — Path TraversalCWE-20 — Improper Input Validation4 documents4 sources
Severity
8.8HIGHNVD
CNA3.8
EPSS
0.2%
top 60.39%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Cisco Identity Services Engine SoftwareCisco Identity Services Engine
Timeline
PublishedNov 4

Description

A vulnerability in the Localdisk Management feature of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to make unauthorized changes to the file system of an affected device. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending a crafted HTTP request with absolute path sequences. A successful exploit could allow the attacker to upload malicious files to arbitrary locations within the file system. Usi…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages2 packages

▶CVEListV5cisco/cisco_identity_services_engine_software3.1.0, 3.1.0 p1, 3.1.0 p3+2

🔴Vulnerability Details

2
GHSA
GHSA-6f25-35p5-r2r2: A vulnerability in the Localdisk Management feature of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to make unau↗2022-11-04
▶
CVEList
CVE-2022-20962: A vulnerability in the Localdisk Management feature of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to make unau↗2022-11-03
▶

📋Vendor Advisories

1
Cisco
Cisco Identity Services Engine Path Traversal Vulnerability↗2022-11-02
▶
CVE-2022-20962 — Cisco vulnerability | cvebase