{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-20194", "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "state": "PUBLISHED", "assignerShortName": "cisco", "dateReserved": "2022-10-27T18:47:50.365Z", "datePublished": "2023-09-07T19:31:49.966Z", "dateUpdated": "2024-08-02T09:05:36.240Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "shortName": "cisco", "dateUpdated": "2024-01-25T16:57:54.347Z"}, "descriptions": [{"lang": "en", "value": "A vulnerability in the ERS API of Cisco ISE could allow an authenticated, remote attacker to read arbitrary files on the underlying operating system of an affected device. To exploit this vulnerability, an attacker must have valid Administrator-level privileges on the affected device. This vulnerability is due to improper privilege management in the ERS API. An attacker could exploit this vulnerability by sending a crafted request to an affected device. A successful exploit could allow the attacker to elevate their privileges beyond the sphere of their intended access level, which would allow them to obtain sensitive information from the underlying operating system. Note: The ERS is not enabled by default. To verify the status of the ERS API in the Admin GUI, choose Administration > Settings > API Settings > API Service Settings."}], "affected": [{"vendor": "Cisco", "product": "Cisco Identity Services Engine Software", "versions": [{"version": "2.6.0", "status": "affected"}, {"version": "2.6.0 p1", "status": "affected"}, {"version": "2.6.0 p2", "status": "affected"}, {"version": "2.6.0 p3", "status": "affected"}, {"version": "2.6.0 p5", "status": "affected"}, {"version": "2.6.0 p6", "status": "affected"}, {"version": "2.6.0 p7", "status": "affected"}, {"version": "2.6.0 p8", "status": "affected"}, {"version": "2.6.0 p9", "status": "affected"}, {"version": "2.6.0 p10", "status": "affected"}, {"version": "2.6.0 p11", "status": "affected"}, {"version": "2.6.0 p12", "status": "affected"}, {"version": "2.7.0", "status": "affected"}, {"version": "2.7.0 p1", "status": "affected"}, {"version": "2.7.0 p2", "status": "affected"}, {"version": "2.7.0 p3", "status": "affected"}, {"version": "2.7.0 p4", "status": "affected"}, {"version": "2.7.0 p5", "status": "affected"}, {"version": "2.7.0 p6", "status": "affected"}, {"version": "2.7.0 p7", "status": "affected"}, {"version": "2.7.0 p9", "status": "affected"}, {"version": "3.0.0", "status": "affected"}, {"version": "3.0.0 p1", "status": "affected"}, {"version": "3.0.0 p2", "status": "affected"}, {"version": "3.0.0 p3", "status": "affected"}, {"version": "3.0.0 p4", "status": "affected"}, {"version": "3.0.0 p5", "status": "affected"}, {"version": "3.0.0 p6", "status": "affected"}, {"version": "3.0.0 p7", "status": "affected"}, {"version": "3.1.0", "status": "affected"}, {"version": "3.1.0 p1", "status": "affected"}, {"version": "3.1.0 p3", "status": "affected"}, {"version": "3.1.0 p4", "status": "affected"}, {"version": "3.1.0 p5", "status": "affected"}, {"version": "3.1.0 p6", "status": "affected"}, {"version": "3.1.0 p7", "status": "affected"}, {"version": "3.2.0", "status": "affected"}, {"version": "3.2.0 p1", "status": "affected"}, {"version": "3.2.0 p2", "status": "affected"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Privilege Chaining", "type": "cwe", "cweId": "CWE-268"}]}], "references": [{"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-priv-esc-KJLp2Aw", "name": "cisco-sa-ise-priv-esc-KJLp2Aw"}], "metrics": [{"format": "cvssV3_1", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "baseScore": 4.9, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE"}}], "exploits": [{"lang": "en", "value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory."}], "source": {"advisory": "cisco-sa-ise-priv-esc-KJLp2Aw", "discovery": "INTERNAL", "defects": ["CSCwd93721"]}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T09:05:36.240Z"}, "title": "CVE Program Container", "references": [{"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-priv-esc-KJLp2Aw", "name": "cisco-sa-ise-priv-esc-KJLp2Aw", "tags": ["x_transferred"]}]}]}}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:cisco:identity_services_engine:*:*:*:*:*:*:*:*", "matchCriteriaId": "DDE2869D-6E9E-4717-A8D4-9E3204889F14", "versionEndIncluding": "2.7", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:identity_services_engine:3.0.0:-:*:*:*:*:*:*", "matchCriteriaId": "A1063044-BCD7-487F-9880-141C30547E36", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:identity_services_engine:3.0.0:patch1:*:*:*:*:*:*", "matchCriteriaId": "DA42E65A-7207-48B8-BE1B-0B352201BC09", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:identity_services_engine:3.0.0:patch2:*:*:*:*:*:*", "matchCriteriaId": "75DDAF38-4D5F-4EE4-A428-68D28FC0DA96", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:identity_services_engine:3.0.0:patch3:*:*:*:*:*:*", "matchCriteriaId": "C5FB6AA6-F8C9-48A6-BDDA-1D25C43564EB", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:identity_services_engine:3.0.0:patch4:*:*:*:*:*:*", "matchCriteriaId": "2B3A267A-5FEA-426D-903E-BD3F4F94A1A4", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:identity_services_engine:3.0.0:patch5:*:*:*:*:*:*", "matchCriteriaId": "B1B3207B-1B9C-41AA-8EF6-8478458462E7", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:identity_services_engine:3.0.0:patch6:*:*:*:*:*:*", "matchCriteriaId": "C5B9E7F3-B0F2-4A6A-B939-A62E9B12CCEB", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:identity_services_engine:3.0.0:patch7:*:*:*:*:*:*", "matchCriteriaId": "EF4C5A58-D0AE-48D6-9757-18C1D5BE5070", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:identity_services_engine:3.1:-:*:*:*:*:*:*", "matchCriteriaId": "C4DB9726-532F-45CE-81FD-45F2F6C7CE51", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:identity_services_engine:3.1:patch1:*:*:*:*:*:*", "matchCriteriaId": "2E8F0066-0EC0-41FD-80BE-55C4ED5F6B0E", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:identity_services_engine:3.1:patch3:*:*:*:*:*:*", "matchCriteriaId": "5D1765DB-1BEF-4CE9-8B86-B91F709600EB", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:identity_services_engine:3.1:patch4:*:*:*:*:*:*", "matchCriteriaId": "3D1E80EF-C3FD-4F7A-B63D-0EAA5C878B11", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:identity_services_engine:3.1:patch5:*:*:*:*:*:*", "matchCriteriaId": "095F27EC-5713-4D4F-AD06-57D3DF068B90", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:identity_services_engine:3.1:patch6:*:*:*:*:*:*", "matchCriteriaId": "FEA5210C-E674-4C4B-9EB3-C681C70005B6", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:identity_services_engine:3.1:patch7:*:*:*:*:*:*", "matchCriteriaId": "C95F2367-A1A0-46B5-AFC0-9929FC899EE2", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:identity_services_engine:3.2:-:*:*:*:*:*:*", "matchCriteriaId": "36722B6C-64A5-4D00-94E1-442878C37A35", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:identity_services_engine:3.2:patch1:*:*:*:*:*:*", "matchCriteriaId": "7EEEA06A-AD58-48D3-8975-B21A961985B3", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:identity_services_engine:3.2:patch2:*:*:*:*:*:*", "matchCriteriaId": "ED937BCD-60F7-4555-99D8-B6229214FA73", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability in the ERS API of Cisco ISE could allow an authenticated, remote attacker to read arbitrary files on the underlying operating system of an affected device. To exploit this vulnerability, an attacker must have valid Administrator-level privileges on the affected device. This vulnerability is due to improper privilege management in the ERS API. An attacker could exploit this vulnerability by sending a crafted request to an affected device. A successful exploit could allow the attacker to elevate their privileges beyond the sphere of their intended access level, which would allow them to obtain sensitive information from the underlying operating system. Note: The ERS is not enabled by default. To verify the status of the ERS API in the Admin GUI, choose Administration > Settings > API Settings > API Service Settings."}, {"lang": "es", "value": "Una vulnerabilidad en la API ERS de Cisco ISE podr\u00eda permitir a un atacante remoto autenticado leer archivos arbitrarios en el sistema operativo subyacente de un dispositivo afectado. Para explotar esta vulnerabilidad, un atacante debe tener privilegios v\u00e1lidos a nivel de administrador en el dispositivo afectado. Esta vulnerabilidad se debe a una gesti\u00f3n inadecuada de privilegios en la API ERS. Un atacante podr\u00eda aprovechar esta vulnerabilidad enviando una solicitud manipulada a un dispositivo afectado. Un exploit exitoso podr\u00eda permitir al atacante elevar sus privilegios m\u00e1s all\u00e1 de la esfera de su nivel de acceso previsto, lo que le permitir\u00eda obtener informaci\u00f3n sensible del sistema operativo subyacente. Nota: El ERS no est\u00e1 habilitado por defecto. Para verificar el estado de la API ERS en la GUI Admin, seleccione Administraci\u00f3n - Configuraci\u00f3n - Configuraci\u00f3n de API - Configuraci\u00f3n del servicio de la API."}], "id": "CVE-2023-20194", "lastModified": "2024-01-25T17:15:34.337", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 3.6, "source": "ykramarz@cisco.com", "type": "Secondary"}]}, "published": "2023-09-07T20:15:07.593", "references": [{"source": "ykramarz@cisco.com", "tags": ["Vendor Advisory"], "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-priv-esc-KJLp2Aw"}], "sourceIdentifier": "ykramarz@cisco.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-269"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-268"}], "source": "ykramarz@cisco.com", "type": "Secondary"}]}

{}