CVE-2024-20296 — Unrestricted File Upload in Cisco Identity Services Engine

CWE-434 — Unrestricted File Upload4 documents4 sources
Severity
7.2HIGHNVD
CNA4.7
EPSS
0.2%
top 63.70%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Cisco Identity Services EngineCisco Identity Services Engine Software
Timeline
PublishedJul 17

Description

A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to upload arbitrary files to an affected device. To exploit this vulnerability, an attacker would need at least valid Policy Admin credentials on the affected device. This vulnerability is due to improper validation of files that are uploaded to the web-based management interface. An attacker could exploit this vulnerability by uploading arbitrary files to a…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HExploitability: 1.2 | Impact: 5.9

Affected Packages2 packages

▶NVDcisco/identity_services_engine3.0.0 — 3.1+3

🔴Vulnerability Details

2
CVEList
CVE-2024-20296: A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to upload↗2024-07-17
▶
GHSA
GHSA-mgj5-j889-643m: A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to upload↗2024-07-17
▶

📋Vendor Advisories

1
Cisco
Cisco Identity Services Engine Arbitrary File Upload Vulnerability↗2024-07-17
▶
CVE-2024-20296 — Unrestricted File Upload in Cisco | cvebase