CVE-2023-20194 — Privilege Chaining in Cisco Identity Services Engine

CWE-268 — Privilege ChainingCWE-269 — Improper Privilege ManagementCWE-78 — OS Command Injection4 documents4 sources
Severity
4.9MEDIUMNVD
EPSS
0.1%
top 80.91%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Cisco Identity Services EngineCisco Identity Services Engine Software
Timeline
PublishedSep 7

Description

A vulnerability in the ERS API of Cisco ISE could allow an authenticated, remote attacker to read arbitrary files on the underlying operating system of an affected device. To exploit this vulnerability, an attacker must have valid Administrator-level privileges on the affected device. This vulnerability is due to improper privilege management in the ERS API. An attacker could exploit this vulnerability by sending a crafted request to an affected device. A successful exploit could allow the attac…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:NExploitability: 1.2 | Impact: 3.6

Affected Packages2 packages

🔴Vulnerability Details

2
GHSA
GHSA-2mg3-562w-27qp: A vulnerability in the ERS API of Cisco ISE could allow an authenticated, remote attacker to read arbitrary files on the underlying operating system o↗2023-09-07
▶
CVEList
CVE-2023-20194: A vulnerability in the ERS API of Cisco ISE could allow an authenticated, remote attacker to read arbitrary files on the underlying operating system o↗2023-09-07
▶

📋Vendor Advisories

1
Cisco
Cisco Identity Services Engine Privilege Escalation Vulnerabilities↗2023-09-06
▶
CVE-2023-20194 — Privilege Chaining in Cisco | cvebase