CVE-2023-20077

Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to download arbitrary files from the filesystem of an affected device. These vulnerabilities are due to insufficient input validation. An attacker could exploit these vulnerabilities by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to download arbitrary files from the underlying filesystem of the affected device.
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:cisco:identity_services_engine:*:*:*:*:*:*:*:*
cpe:2.3:a:cisco:identity_services_engine:3.2:-:*:*:*:*:*:*

History

26 May 2023, 14:22

Type Values Removed Values Added
References (CISCO) https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-file-dwnld-Srcdnkd2 - (CISCO) https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-file-dwnld-Srcdnkd2 - Vendor Advisory
CWE CWE-22
CVSS v2 : unknown
v3 : unknown
v2 : unknown
v3 : 6.5
First Time Cisco
Cisco identity Services Engine
CPE cpe:2.3:a:cisco:identity_services_engine:*:*:*:*:*:*:*:*
cpe:2.3:a:cisco:identity_services_engine:3.2:-:*:*:*:*:*:*

Information

Published : 2023-05-18 03:15

Updated : 2024-02-28 20:13


NVD link : CVE-2023-20077

Mitre link : CVE-2023-20077

CVE.ORG link : CVE-2023-20077


JSON object : View

Products Affected

cisco

  • identity_services_engine
CWE
CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CWE-37

Path Traversal: '/absolute/pathname/here'