Cisco Identity Services Engine Vulnerabilities (cisco-sa-ise-7Q4TNYUx)

high Nessus Plugin ID 169426

Language:

Synopsis

The remote device is missing a vendor-supplied security patch.

Description

According to its self-reported version, Cisco Identity Services Engine is affected by multiple vulnerabilities.

- A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to inject arbitrary commands on the underlying operating system. (CVE-2022-20964)

- A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to conduct cross-site scripting attacks against other users of the application web-based management interface. (CVE-2022-20966)

- A vulnerability in the web-based management interface External RADIUS Server feature of Cisco ISE could allow an authenticated, remote attacker to conduct cross-site scripting attacks against other users of the application web-based management interface. (CVE-2022-20967)

- A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to bypass security restrictions within the web-based management interface. (CVE-2022-20965)

Please see the included Cisco BIDs and Cisco Security Advisory for more information.

Solution

Upgrade to the relevant fixed version referenced in Cisco bug IDs CSCwc98823, CSCwc98828, CSCwc98831, CSCwc98833

Plugin Details

Severity: High

ID: 169426

File Name: cisco-sa-ise-7Q4TNYUx.nasl

Version: 1.5

Type: combined

Family: CISCO

Published: 12/30/2022

Updated: 8/25/2023

Configuration: Enable paranoid mode

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 5.9

CVSS v2

Risk Factor: High

Base Score: 9

Temporal Score: 6.7

Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2022-20964

CVSS v3

Risk Factor: High

Base Score: 8.8

Temporal Score: 7.7

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/h:cisco:identity_services_engine, cpe:/a:cisco:identity_services_engine, cpe:/a:cisco:identity_services_engine_software

Required KB Items: Host/Cisco/ISE/version, Settings/ParanoidReport

Exploit Ease: No known exploits are available

Patch Publication Date: 11/16/2022

Vulnerability Publication Date: 11/16/2022

Reference Information

CVE: CVE-2022-20964, CVE-2022-20965, CVE-2022-20966, CVE-2022-20967

CWE: 648, 78, 79

CISCO-SA: cisco-sa-ise-7Q4TNYUx

IAVA: 2022-A-0462-S

CISCO-BUG-ID: CSCwc98823, CSCwc98828, CSCwc98831, CSCwc98833

Detections

Analytics