Cisco Identity Services Engine Authorization Bypass Vulnerabilities
Cisco fixed authorization bypass flaws in ISE and ISE-PIC web management letting authenticated admins modify file descriptions via crafted HTTP requests.
Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine and ISE Passive Identity Connector result from missing server-side validation of Administrator permissions. An authenticated remote attacker with valid Administrator credentials can submit crafted HTTP requests to modify descriptions of files on specific pages. Cisco has released software updates addressing the issues.
- Requires valid Administrator credentials to exploit
- Lack of server-side validation of Administrator permissions
- Impact limited to modifying file descriptions on specific pages
- Affects both ISE and ISE Passive Identity Connector (ISE-PIC)
Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow an authenticated, remote attacker to modify parts of the configuration on an affected device. These vulnerabilities are due to the lack of server-side validation of Administrator permissions. An attacker could exploit these vulnerabilities by submitting a crafted HTTP request to an affected system. A successful exploit could allow the attacker to modify descriptions of files on specific pages. To exploit these vulnerabilities, an attacker would need valid Administrator credentials. Cisco has released software updates that…
This source does not provide full text. Read it at sec.cloudapps.cisco.com.