CVE-2024-20296 - Vulnerability Details

Vendors	Products
Cisco	Identity Services Engine

Link	Providers
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-file-upload-krW2TxA9

Type	Values Removed	Values Added
First Time appeared		Cisco Cisco identity Services Engine
CPEs		cpe:2.3:a:cisco:identity_services_engine:::::::: cpe:2.3:a:cisco:identity_services_engine:3.1.0:-:::::: cpe:2.3:a:cisco:identity_services_engine:3.1.0:patch1:::::: cpe:2.3:a:cisco:identity_services_engine:3.1.0:patch2:::::: cpe:2.3:a:cisco:identity_services_engine:3.1.0:patch3:::::: cpe:2.3:a:cisco:identity_services_engine:3.1.0:patch4:::::: cpe:2.3:a:cisco:identity_services_engine:3.1.0:patch5:::::: cpe:2.3:a:cisco:identity_services_engine:3.1.0:patch6:::::: cpe:2.3:a:cisco:identity_services_engine:3.1.0:patch7:::::: cpe:2.3:a:cisco:identity_services_engine:3.1.0:patch8:::::: cpe:2.3:a:cisco:identity_services_engine:3.1.0:patch9:::::: cpe:2.3:a:cisco:identity_services_engine:3.2.0:-:::::: cpe:2.3:a:cisco:identity_services_engine:3.2.0:patch1:::::: cpe:2.3:a:cisco:identity_services_engine:3.2.0:patch2:::::: cpe:2.3:a:cisco:identity_services_engine:3.2.0:patch3:::::: cpe:2.3:a:cisco:identity_services_engine:3.2.0:patch4:::::: cpe:2.3:a:cisco:identity_services_engine:3.2.0:patch5:::::: cpe:2.3:a:cisco:identity_services_engine:3.2.0:patch6:::::: cpe:2.3:a:cisco:identity_services_engine:3.3.0:-:::::: cpe:2.3:a:cisco:identity_services_engine:3.3.0:patch1:::::: cpe:2.3:a:cisco:identity_services_engine:3.3.0:patch2::::::
Vendors & Products		Cisco Cisco identity Services Engine

Show plain JSON

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-20296", "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "state": "PUBLISHED", "assignerShortName": "cisco", "dateReserved": "2023-11-08T15:08:07.629Z", "datePublished": "2024-07-17T16:28:22.193Z", "dateUpdated": "2024-08-01T21:59:41.103Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "shortName": "cisco", "dateUpdated": "2024-07-17T16:28:22.193Z"}, "descriptions": [{"lang": "en", "value": "A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to upload arbitrary files to an affected device. To exploit this vulnerability, an attacker would need at least valid Policy Admin credentials on the affected device.\r\n\r This vulnerability is due to improper validation of files that are uploaded to the web-based management interface. An attacker could exploit this vulnerability by uploading arbitrary files to an affected device. A successful exploit could allow the attacker to store malicious files on the system, execute arbitrary commands on the operating system, and elevate privileges to root."}], "affected": [{"vendor": "Cisco", "product": "Cisco Identity Services Engine Software", "versions": [{"version": "2.7.0", "status": "affected"}, {"version": "2.7.0 p1", "status": "affected"}, {"version": "2.7.0 p2", "status": "affected"}, {"version": "2.7.0 p3", "status": "affected"}, {"version": "2.7.0 p4", "status": "affected"}, {"version": "2.7.0 p5", "status": "affected"}, {"version": "2.7.0 p6", "status": "affected"}, {"version": "2.7.0 p7", "status": "affected"}, {"version": "2.7.0 p8", "status": "affected"}, {"version": "2.7.0 p9", "status": "affected"}, {"version": "2.7.0 p10", "status": "affected"}, {"version": "3.0.0", "status": "affected"}, {"version": "3.0.0 p1", "status": "affected"}, {"version": "3.0.0 p2", "status": "affected"}, {"version": "3.0.0 p3", "status": "affected"}, {"version": "3.0.0 p4", "status": "affected"}, {"version": "3.0.0 p5", "status": "affected"}, {"version": "3.0.0 p6", "status": "affected"}, {"version": "3.0.0 p7", "status": "affected"}, {"version": "3.0.0 p8", "status": "affected"}, {"version": "3.1.0", "status": "affected"}, {"version": "3.1.0 p1", "status": "affected"}, {"version": "3.1.0 p3", "status": "affected"}, {"version": "3.1.0 p2", "status": "affected"}, {"version": "3.1.0 p4", "status": "affected"}, {"version": "3.1.0 p5", "status": "affected"}, {"version": "3.1.0 p6", "status": "affected"}, {"version": "3.1.0 p7", "status": "affected"}, {"version": "3.1.0 p8", "status": "affected"}, {"version": "3.1.0 p9", "status": "affected"}, {"version": "3.2.0", "status": "affected"}, {"version": "3.2.0 p1", "status": "affected"}, {"version": "3.2.0 p2", "status": "affected"}, {"version": "3.2.0 p3", "status": "affected"}, {"version": "3.2.0 p4", "status": "affected"}, {"version": "3.2.0 p5", "status": "affected"}, {"version": "3.2.0 p6", "status": "affected"}, {"version": "3.3.0", "status": "affected"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Unrestricted Upload of File with Dangerous Type", "type": "cwe", "cweId": "CWE-434"}]}], "references": [{"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-file-upload-krW2TxA9", "name": "cisco-sa-ise-file-upload-krW2TxA9"}], "metrics": [{"format": "cvssV3_1", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L", "baseScore": 4.7, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "LOW"}}], "exploits": [{"lang": "en", "value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."}], "source": {"advisory": "cisco-sa-ise-file-upload-krW2TxA9", "discovery": "EXTERNAL", "defects": ["CSCwh97876"]}}, "adp": [{"affected": [{"vendor": "cisco", "product": "identity_services_engine_software", "cpes": ["cpe:2.3:a:cisco:identity_services_engine_software:2.7.0:*:*:*:*:*:*:*", "cpe:2.3:a:cisco:identity_services_engine_software:2.7.0_p1:*:*:*:*:*:*:*", "cpe:2.3:a:cisco:identity_services_engine_software:2.7.0_p2:*:*:*:*:*:*:*", "cpe:2.3:a:cisco:identity_services_engine_software:2.7.0_p3:*:*:*:*:*:*:*", "cpe:2.3:a:cisco:identity_services_engine_software:2.7.0_p4:*:*:*:*:*:*:*", "cpe:2.3:a:cisco:identity_services_engine_software:2.7.0_p5:*:*:*:*:*:*:*", "cpe:2.3:a:cisco:identity_services_engine_software:2.7.0_p6:*:*:*:*:*:*:*", "cpe:2.3:a:cisco:identity_services_engine_software:2.7.0_p7:*:*:*:*:*:*:*", "cpe:2.3:a:cisco:identity_services_engine_software:2.7.0_p8:*:*:*:*:*:*:*", "cpe:2.3:a:cisco:identity_services_engine_software:2.7.0_p9:*:*:*:*:*:*:*", "cpe:2.3:a:cisco:identity_services_engine_software:2.7.0_p10:*:*:*:*:*:*:*", "cpe:2.3:a:cisco:identity_services_engine_software:3.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:cisco:identity_services_engine_software:3.0.0_p1:*:*:*:*:*:*:*", "cpe:2.3:a:cisco:identity_services_engine_software:3.0.0_p2:*:*:*:*:*:*:*", "cpe:2.3:a:cisco:identity_services_engine_software:3.0.0_p3:*:*:*:*:*:*:*", "cpe:2.3:a:cisco:identity_services_engine_software:3.0.0_p4:*:*:*:*:*:*:*", "cpe:2.3:a:cisco:identity_services_engine_software:3.0.0_p5:*:*:*:*:*:*:*", "cpe:2.3:a:cisco:identity_services_engine_software:3.0.0_p6:*:*:*:*:*:*:*", "cpe:2.3:a:cisco:identity_services_engine_software:3.0.0_p7:*:*:*:*:*:*:*", "cpe:2.3:a:cisco:identity_services_engine_software:3.0.0_p8:*:*:*:*:*:*:*", "cpe:2.3:a:cisco:identity_services_engine_software:3.1.0:*:*:*:*:*:*:*", "cpe:2.3:a:cisco:identity_services_engine_software:3.1.0_p1:*:*:*:*:*:*:*", "cpe:2.3:a:cisco:identity_services_engine_software:3.1.0_p3:*:*:*:*:*:*:*", "cpe:2.3:a:cisco:identity_services_engine_software:3.1.0_p2:*:*:*:*:*:*:*", "cpe:2.3:a:cisco:identity_services_engine_software:3.1.0_p4:*:*:*:*:*:*:*", "cpe:2.3:a:cisco:identity_services_engine_software:3.1.0_p5:*:*:*:*:*:*:*", "cpe:2.3:a:cisco:identity_services_engine_software:3.1.0_p6:*:*:*:*:*:*:*", "cpe:2.3:a:cisco:identity_services_engine_software:3.1.0_p7:*:*:*:*:*:*:*", "cpe:2.3:a:cisco:identity_services_engine_software:3.1.0_p8:*:*:*:*:*:*:*", "cpe:2.3:a:cisco:identity_services_engine_software:3.1.0_p9:*:*:*:*:*:*:*", "cpe:2.3:a:cisco:identity_services_engine_software:3.2.0:*:*:*:*:*:*:*", "cpe:2.3:a:cisco:identity_services_engine_software:3.2.0_p1:*:*:*:*:*:*:*", "cpe:2.3:a:cisco:identity_services_engine_software:3.2.0_p2:*:*:*:*:*:*:*", "cpe:2.3:a:cisco:identity_services_engine_software:3.2.0_p3:*:*:*:*:*:*:*", "cpe:2.3:a:cisco:identity_services_engine_software:3.2.0_p4:*:*:*:*:*:*:*", "cpe:2.3:a:cisco:identity_services_engine_software:3.2.0_p5:*:*:*:*:*:*:*", "cpe:2.3:a:cisco:identity_services_engine_software:3.2.0_p6:*:*:*:*:*:*:*", "cpe:2.3:a:cisco:identity_services_engine_software:3.3.0:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "2.7.0", "status": "affected"}, {"version": "2.7.0_p1", "status": "affected"}, {"version": "2.7.0_p2", "status": "affected"}, {"version": "2.7.0_p3", "status": "affected"}, {"version": "2.7.0_p4", "status": "affected"}, {"version": "2.7.0_p5", "status": "affected"}, {"version": "2.7.0_p6", "status": "affected"}, {"version": "2.7.0_p7", "status": "affected"}, {"version": "2.7.0_p8", "status": "affected"}, {"version": "2.7.0_p9", "status": "affected"}, {"version": "2.7.0_p10", "status": "affected"}, {"version": "3.0.0", "status": "affected"}, {"version": "3.0.0_p1", "status": "affected"}, {"version": "3.0.0_p2", "status": "affected"}, {"version": "3.0.0_p3", "status": "affected"}, {"version": "3.0.0_p4", "status": "affected"}, {"version": "3.0.0_p5", "status": "affected"}, {"version": "3.0.0_p6", "status": "affected"}, {"version": "3.0.0_p7", "status": "affected"}, {"version": "3.0.0_p8", "status": "affected"}, {"version": "3.1.0", "status": "affected"}, {"version": "3.1.0_p1", "status": "affected"}, {"version": "3.1.0_p3", "status": "affected"}, {"version": "3.1.0_p2", "status": "affected"}, {"version": "3.1.0_p4", "status": "affected"}, {"version": "3.1.0_p5", "status": "affected"}, {"version": "3.1.0_p6", "status": "affected"}, {"version": "3.1.0_p7", "status": "affected"}, {"version": "3.1.0_p8", "status": "affected"}, {"version": "3.1.0_p9", "status": "affected"}, {"version": "3.2.0", "status": "affected"}, {"version": "3.2.0_p1", "status": "affected"}, {"version": "3.2.0_p2", "status": "affected"}, {"version": "3.2.0_p3", "status": "affected"}, {"version": "3.2.0_p4", "status": "affected"}, {"version": "3.2.0_p5", "status": "affected"}, {"version": "3.2.0_p6", "status": "affected"}, {"version": "3.3.0", "status": "affected"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-07-17T00:00:00+00:00", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2024-20296"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-18T03:55:22.366Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T21:59:41.103Z"}, "title": "CVE Program Container", "references": [{"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-file-upload-krW2TxA9", "name": "cisco-sa-ise-file-upload-krW2TxA9", "tags": ["x_transferred"]}]}]}}

{

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

cveMetadata : { »

cveId : CVE-2024-20296 (string)

assignerOrgId : d1c1063e-7a18-46af-9102-31f8928bc633 (string)

state : PUBLISHED (string)

assignerShortName : cisco (string)

dateReserved : 2023-11-08T15:08:07.629Z (string)

datePublished : 2024-07-17T16:28:22.193Z (string)

dateUpdated : 2024-08-01T21:59:41.103Z (string)

}

containers : { »

cna : { »

providerMetadata : { »

orgId : d1c1063e-7a18-46af-9102-31f8928bc633 (string)

shortName : cisco (string)

dateUpdated : 2024-07-17T16:28:22.193Z (string)

}

descriptions : [ »

0 : { »

lang : en (string)

value : A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to upload arbitrary files to an affected device. To exploit this vulnerability, an attacker would need at least valid Policy Admin credentials on the affected device. This vulnerability is due to improper validation of files that are uploaded to the web-based management interface. An attacker could exploit this vulnerability by uploading arbitrary files to an affected device. A successful exploit could allow the attacker to store malicious files on the system, execute arbitrary commands on the operating system, and elevate privileges to root. (string)

}

]

affected : [ »

0 : { »

vendor : Cisco (string)

product : Cisco Identity Services Engine Software (string)

versions : [ »

0 : { »

version : 2.7.0 (string)

status : affected (string)

}

1 : { »

version : 2.7.0 p1 (string)

status : affected (string)

}

2 : { »

version : 2.7.0 p2 (string)

status : affected (string)

}

3 : { »

version : 2.7.0 p3 (string)

status : affected (string)

}

4 : { »

version : 2.7.0 p4 (string)

status : affected (string)

}

5 : { »

version : 2.7.0 p5 (string)

status : affected (string)

}

6 : { »

version : 2.7.0 p6 (string)

status : affected (string)

}

7 : { »

version : 2.7.0 p7 (string)

status : affected (string)

}

8 : { »

version : 2.7.0 p8 (string)

status : affected (string)

}

9 : { »

version : 2.7.0 p9 (string)

status : affected (string)

}

10 : { »

version : 2.7.0 p10 (string)

status : affected (string)

}

11 : { »

version : 3.0.0 (string)

status : affected (string)

}

12 : { »

version : 3.0.0 p1 (string)

status : affected (string)

}

13 : { »

version : 3.0.0 p2 (string)

status : affected (string)

}

14 : { »

version : 3.0.0 p3 (string)

status : affected (string)

}

15 : { »

version : 3.0.0 p4 (string)

status : affected (string)

}

16 : { »

version : 3.0.0 p5 (string)

status : affected (string)

}

17 : { »

version : 3.0.0 p6 (string)

status : affected (string)

}

18 : { »

version : 3.0.0 p7 (string)

status : affected (string)

}

19 : { »

version : 3.0.0 p8 (string)

status : affected (string)

}

20 : { »

version : 3.1.0 (string)

status : affected (string)

}

21 : { »

version : 3.1.0 p1 (string)

status : affected (string)

}

22 : { »

version : 3.1.0 p3 (string)

status : affected (string)

}

23 : { »

version : 3.1.0 p2 (string)

status : affected (string)

}

24 : { »

version : 3.1.0 p4 (string)

status : affected (string)

}

25 : { »

version : 3.1.0 p5 (string)

status : affected (string)

}

26 : { »

version : 3.1.0 p6 (string)

status : affected (string)

}

27 : { »

version : 3.1.0 p7 (string)

status : affected (string)

}

28 : { »

version : 3.1.0 p8 (string)

status : affected (string)

}

29 : { »

version : 3.1.0 p9 (string)

status : affected (string)

}

30 : { »

version : 3.2.0 (string)

status : affected (string)

}

31 : { »

version : 3.2.0 p1 (string)

status : affected (string)

}

32 : { »

version : 3.2.0 p2 (string)

status : affected (string)

}

33 : { »

version : 3.2.0 p3 (string)

status : affected (string)

}

34 : { »

version : 3.2.0 p4 (string)

status : affected (string)

}

35 : { »

version : 3.2.0 p5 (string)

status : affected (string)

}

36 : { »

version : 3.2.0 p6 (string)

status : affected (string)

}

37 : { »

version : 3.3.0 (string)

status : affected (string)

}

]

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

lang : en (string)

description : Unrestricted Upload of File with Dangerous Type (string)

type : cwe (string)

cweId : CWE-434 (string)

}

]

}

]

references : [ »

0 : { »

url : https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-file-upload-krW2TxA9 (string)

name : cisco-sa-ise-file-upload-krW2TxA9 (string)

}

]

metrics : [ »

0 : { »

format : cvssV3_1 (string)

cvssV3_1 : { »

version : 3.1 (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L (string)

baseScore : 4.7 (number)

baseSeverity : MEDIUM (string)

attackVector : NETWORK (string)

attackComplexity : LOW (string)

privilegesRequired : HIGH (string)

userInteraction : NONE (string)

scope : UNCHANGED (string)

confidentialityImpact : LOW (string)

integrityImpact : LOW (string)

availabilityImpact : LOW (string)

}

]

exploits : [ »

0 : { »

lang : en (string)

value : The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory. (string)

}

]

source : { »

advisory : cisco-sa-ise-file-upload-krW2TxA9 (string)

discovery : EXTERNAL (string)

defects : [ »

0 : CSCwh97876 (string)

]

}

adp : [ »

0 : { »

affected : [ »

0 : { »

vendor : cisco (string)

product : identity_services_engine_software (string)

cpes : [ »

0 : cpe:2.3:a:cisco:identity_services_engine_software:2.7.0:*:*:*:*:*:*:* (string)

1 : cpe:2.3:a:cisco:identity_services_engine_software:2.7.0_p1:*:*:*:*:*:*:* (string)

2 : cpe:2.3:a:cisco:identity_services_engine_software:2.7.0_p2:*:*:*:*:*:*:* (string)

3 : cpe:2.3:a:cisco:identity_services_engine_software:2.7.0_p3:*:*:*:*:*:*:* (string)

4 : cpe:2.3:a:cisco:identity_services_engine_software:2.7.0_p4:*:*:*:*:*:*:* (string)

5 : cpe:2.3:a:cisco:identity_services_engine_software:2.7.0_p5:*:*:*:*:*:*:* (string)

6 : cpe:2.3:a:cisco:identity_services_engine_software:2.7.0_p6:*:*:*:*:*:*:* (string)

7 : cpe:2.3:a:cisco:identity_services_engine_software:2.7.0_p7:*:*:*:*:*:*:* (string)

8 : cpe:2.3:a:cisco:identity_services_engine_software:2.7.0_p8:*:*:*:*:*:*:* (string)

9 : cpe:2.3:a:cisco:identity_services_engine_software:2.7.0_p9:*:*:*:*:*:*:* (string)

10 : cpe:2.3:a:cisco:identity_services_engine_software:2.7.0_p10:*:*:*:*:*:*:* (string)

11 : cpe:2.3:a:cisco:identity_services_engine_software:3.0.0:*:*:*:*:*:*:* (string)

12 : cpe:2.3:a:cisco:identity_services_engine_software:3.0.0_p1:*:*:*:*:*:*:* (string)

13 : cpe:2.3:a:cisco:identity_services_engine_software:3.0.0_p2:*:*:*:*:*:*:* (string)

14 : cpe:2.3:a:cisco:identity_services_engine_software:3.0.0_p3:*:*:*:*:*:*:* (string)

15 : cpe:2.3:a:cisco:identity_services_engine_software:3.0.0_p4:*:*:*:*:*:*:* (string)

16 : cpe:2.3:a:cisco:identity_services_engine_software:3.0.0_p5:*:*:*:*:*:*:* (string)

17 : cpe:2.3:a:cisco:identity_services_engine_software:3.0.0_p6:*:*:*:*:*:*:* (string)

18 : cpe:2.3:a:cisco:identity_services_engine_software:3.0.0_p7:*:*:*:*:*:*:* (string)

19 : cpe:2.3:a:cisco:identity_services_engine_software:3.0.0_p8:*:*:*:*:*:*:* (string)

20 : cpe:2.3:a:cisco:identity_services_engine_software:3.1.0:*:*:*:*:*:*:* (string)

21 : cpe:2.3:a:cisco:identity_services_engine_software:3.1.0_p1:*:*:*:*:*:*:* (string)

22 : cpe:2.3:a:cisco:identity_services_engine_software:3.1.0_p3:*:*:*:*:*:*:* (string)

23 : cpe:2.3:a:cisco:identity_services_engine_software:3.1.0_p2:*:*:*:*:*:*:* (string)

24 : cpe:2.3:a:cisco:identity_services_engine_software:3.1.0_p4:*:*:*:*:*:*:* (string)

25 : cpe:2.3:a:cisco:identity_services_engine_software:3.1.0_p5:*:*:*:*:*:*:* (string)

26 : cpe:2.3:a:cisco:identity_services_engine_software:3.1.0_p6:*:*:*:*:*:*:* (string)

27 : cpe:2.3:a:cisco:identity_services_engine_software:3.1.0_p7:*:*:*:*:*:*:* (string)

28 : cpe:2.3:a:cisco:identity_services_engine_software:3.1.0_p8:*:*:*:*:*:*:* (string)

29 : cpe:2.3:a:cisco:identity_services_engine_software:3.1.0_p9:*:*:*:*:*:*:* (string)

30 : cpe:2.3:a:cisco:identity_services_engine_software:3.2.0:*:*:*:*:*:*:* (string)

31 : cpe:2.3:a:cisco:identity_services_engine_software:3.2.0_p1:*:*:*:*:*:*:* (string)

32 : cpe:2.3:a:cisco:identity_services_engine_software:3.2.0_p2:*:*:*:*:*:*:* (string)

33 : cpe:2.3:a:cisco:identity_services_engine_software:3.2.0_p3:*:*:*:*:*:*:* (string)

34 : cpe:2.3:a:cisco:identity_services_engine_software:3.2.0_p4:*:*:*:*:*:*:* (string)

35 : cpe:2.3:a:cisco:identity_services_engine_software:3.2.0_p5:*:*:*:*:*:*:* (string)

36 : cpe:2.3:a:cisco:identity_services_engine_software:3.2.0_p6:*:*:*:*:*:*:* (string)

37 : cpe:2.3:a:cisco:identity_services_engine_software:3.3.0:*:*:*:*:*:*:* (string)

]

defaultStatus : unknown (string)

versions : [ »

0 : { »

version : 2.7.0 (string)

status : affected (string)

}

1 : { »

version : 2.7.0_p1 (string)

status : affected (string)

}

2 : { »

version : 2.7.0_p2 (string)

status : affected (string)

}

3 : { »

version : 2.7.0_p3 (string)

status : affected (string)

}

4 : { »

version : 2.7.0_p4 (string)

status : affected (string)

}

5 : { »

version : 2.7.0_p5 (string)

status : affected (string)

}

6 : { »

version : 2.7.0_p6 (string)

status : affected (string)

}

7 : { »

version : 2.7.0_p7 (string)

status : affected (string)

}

8 : { »

version : 2.7.0_p8 (string)

status : affected (string)

}

9 : { »

version : 2.7.0_p9 (string)

status : affected (string)

}

10 : { »

version : 2.7.0_p10 (string)

status : affected (string)

}

11 : { »

version : 3.0.0 (string)

status : affected (string)

}

12 : { »

version : 3.0.0_p1 (string)

status : affected (string)

}

13 : { »

version : 3.0.0_p2 (string)

status : affected (string)

}

14 : { »

version : 3.0.0_p3 (string)

status : affected (string)

}

15 : { »

version : 3.0.0_p4 (string)

status : affected (string)

}

16 : { »

version : 3.0.0_p5 (string)

status : affected (string)

}

17 : { »

version : 3.0.0_p6 (string)

status : affected (string)

}

18 : { »

version : 3.0.0_p7 (string)

status : affected (string)

}

19 : { »

version : 3.0.0_p8 (string)

status : affected (string)

}

20 : { »

version : 3.1.0 (string)

status : affected (string)

}

21 : { »

version : 3.1.0_p1 (string)

status : affected (string)

}

22 : { »

version : 3.1.0_p3 (string)

status : affected (string)

}

23 : { »

version : 3.1.0_p2 (string)

status : affected (string)

}

24 : { »

version : 3.1.0_p4 (string)

status : affected (string)

}

25 : { »

version : 3.1.0_p5 (string)

status : affected (string)

}

26 : { »

version : 3.1.0_p6 (string)

status : affected (string)

}

27 : { »

version : 3.1.0_p7 (string)

status : affected (string)

}

28 : { »

version : 3.1.0_p8 (string)

status : affected (string)

}

29 : { »

version : 3.1.0_p9 (string)

status : affected (string)

}

30 : { »

version : 3.2.0 (string)

status : affected (string)

}

31 : { »

version : 3.2.0_p1 (string)

status : affected (string)

}

32 : { »

version : 3.2.0_p2 (string)

status : affected (string)

}

33 : { »

version : 3.2.0_p3 (string)

status : affected (string)

}

34 : { »

version : 3.2.0_p4 (string)

status : affected (string)

}

35 : { »

version : 3.2.0_p5 (string)

status : affected (string)

}

36 : { »

version : 3.2.0_p6 (string)

status : affected (string)

}

37 : { »

version : 3.3.0 (string)

status : affected (string)

}

]

}

]

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

timestamp : 2024-07-17T00:00:00+00:00 (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : total (string)

}

]

role : CISA Coordinator (string)

version : 2.0.3 (string)

id : CVE-2024-20296 (string)

}

]

title : CISA ADP Vulnrichment (string)

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2024-07-18T03:55:22.366Z (string)

}

1 : { »

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-01T21:59:41.103Z (string)

}

title : CVE Program Container (string)

references : [ »

0 : { »

url : https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-file-upload-krW2TxA9 (string)

name : cisco-sa-ise-file-upload-krW2TxA9 (string)

tags : [ »

0 : x_transferred (string)

]

}

]

}

]

}

Show plain JSON

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-file-upload-krW2TxA9", "name": "cisco-sa-ise-file-upload-krW2TxA9", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T21:59:41.103Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-20296", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-07-17T21:12:19.717053Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:cisco:identity_services_engine_software:2.7.0:*:*:*:*:*:*:*", "cpe:2.3:a:cisco:identity_services_engine_software:2.7.0_p1:*:*:*:*:*:*:*", "cpe:2.3:a:cisco:identity_services_engine_software:2.7.0_p2:*:*:*:*:*:*:*", "cpe:2.3:a:cisco:identity_services_engine_software:2.7.0_p3:*:*:*:*:*:*:*", "cpe:2.3:a:cisco:identity_services_engine_software:2.7.0_p4:*:*:*:*:*:*:*", "cpe:2.3:a:cisco:identity_services_engine_software:2.7.0_p5:*:*:*:*:*:*:*", "cpe:2.3:a:cisco:identity_services_engine_software:2.7.0_p6:*:*:*:*:*:*:*", "cpe:2.3:a:cisco:identity_services_engine_software:2.7.0_p7:*:*:*:*:*:*:*", "cpe:2.3:a:cisco:identity_services_engine_software:2.7.0_p8:*:*:*:*:*:*:*", "cpe:2.3:a:cisco:identity_services_engine_software:2.7.0_p9:*:*:*:*:*:*:*", "cpe:2.3:a:cisco:identity_services_engine_software:2.7.0_p10:*:*:*:*:*:*:*", "cpe:2.3:a:cisco:identity_services_engine_software:3.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:cisco:identity_services_engine_software:3.0.0_p1:*:*:*:*:*:*:*", "cpe:2.3:a:cisco:identity_services_engine_software:3.0.0_p2:*:*:*:*:*:*:*", "cpe:2.3:a:cisco:identity_services_engine_software:3.0.0_p3:*:*:*:*:*:*:*", "cpe:2.3:a:cisco:identity_services_engine_software:3.0.0_p4:*:*:*:*:*:*:*", "cpe:2.3:a:cisco:identity_services_engine_software:3.0.0_p5:*:*:*:*:*:*:*", "cpe:2.3:a:cisco:identity_services_engine_software:3.0.0_p6:*:*:*:*:*:*:*", "cpe:2.3:a:cisco:identity_services_engine_software:3.0.0_p7:*:*:*:*:*:*:*", "cpe:2.3:a:cisco:identity_services_engine_software:3.0.0_p8:*:*:*:*:*:*:*", "cpe:2.3:a:cisco:identity_services_engine_software:3.1.0:*:*:*:*:*:*:*", "cpe:2.3:a:cisco:identity_services_engine_software:3.1.0_p1:*:*:*:*:*:*:*", "cpe:2.3:a:cisco:identity_services_engine_software:3.1.0_p3:*:*:*:*:*:*:*", "cpe:2.3:a:cisco:identity_services_engine_software:3.1.0_p2:*:*:*:*:*:*:*", "cpe:2.3:a:cisco:identity_services_engine_software:3.1.0_p4:*:*:*:*:*:*:*", "cpe:2.3:a:cisco:identity_services_engine_software:3.1.0_p5:*:*:*:*:*:*:*", "cpe:2.3:a:cisco:identity_services_engine_software:3.1.0_p6:*:*:*:*:*:*:*", "cpe:2.3:a:cisco:identity_services_engine_software:3.1.0_p7:*:*:*:*:*:*:*", "cpe:2.3:a:cisco:identity_services_engine_software:3.1.0_p8:*:*:*:*:*:*:*", "cpe:2.3:a:cisco:identity_services_engine_software:3.1.0_p9:*:*:*:*:*:*:*", "cpe:2.3:a:cisco:identity_services_engine_software:3.2.0:*:*:*:*:*:*:*", "cpe:2.3:a:cisco:identity_services_engine_software:3.2.0_p1:*:*:*:*:*:*:*", "cpe:2.3:a:cisco:identity_services_engine_software:3.2.0_p2:*:*:*:*:*:*:*", "cpe:2.3:a:cisco:identity_services_engine_software:3.2.0_p3:*:*:*:*:*:*:*", "cpe:2.3:a:cisco:identity_services_engine_software:3.2.0_p4:*:*:*:*:*:*:*", "cpe:2.3:a:cisco:identity_services_engine_software:3.2.0_p5:*:*:*:*:*:*:*", "cpe:2.3:a:cisco:identity_services_engine_software:3.2.0_p6:*:*:*:*:*:*:*", "cpe:2.3:a:cisco:identity_services_engine_software:3.3.0:*:*:*:*:*:*:*"], "vendor": "cisco", "product": "identity_services_engine_software", "versions": [{"status": "affected", "version": "2.7.0"}, {"status": "affected", "version": "2.7.0_p1"}, {"status": "affected", "version": "2.7.0_p2"}, {"status": "affected", "version": "2.7.0_p3"}, {"status": "affected", "version": "2.7.0_p4"}, {"status": "affected", "version": "2.7.0_p5"}, {"status": "affected", "version": "2.7.0_p6"}, {"status": "affected", "version": "2.7.0_p7"}, {"status": "affected", "version": "2.7.0_p8"}, {"status": "affected", "version": "2.7.0_p9"}, {"status": "affected", "version": "2.7.0_p10"}, {"status": "affected", "version": "3.0.0"}, {"status": "affected", "version": "3.0.0_p1"}, {"status": "affected", "version": "3.0.0_p2"}, {"status": "affected", "version": "3.0.0_p3"}, {"status": "affected", "version": "3.0.0_p4"}, {"status": "affected", "version": "3.0.0_p5"}, {"status": "affected", "version": "3.0.0_p6"}, {"status": "affected", "version": "3.0.0_p7"}, {"status": "affected", "version": "3.0.0_p8"}, {"status": "affected", "version": "3.1.0"}, {"status": "affected", "version": "3.1.0_p1"}, {"status": "affected", "version": "3.1.0_p3"}, {"status": "affected", "version": "3.1.0_p2"}, {"status": "affected", "version": "3.1.0_p4"}, {"status": "affected", "version": "3.1.0_p5"}, {"status": "affected", "version": "3.1.0_p6"}, {"status": "affected", "version": "3.1.0_p7"}, {"status": "affected", "version": "3.1.0_p8"}, {"status": "affected", "version": "3.1.0_p9"}, {"status": "affected", "version": "3.2.0"}, {"status": "affected", "version": "3.2.0_p1"}, {"status": "affected", "version": "3.2.0_p2"}, {"status": "affected", "version": "3.2.0_p3"}, {"status": "affected", "version": "3.2.0_p4"}, {"status": "affected", "version": "3.2.0_p5"}, {"status": "affected", "version": "3.2.0_p6"}, {"status": "affected", "version": "3.3.0"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-17T21:14:19.971Z"}}], "cna": {"source": {"defects": ["CSCwh97876"], "advisory": "cisco-sa-ise-file-upload-krW2TxA9", "discovery": "EXTERNAL"}, "metrics": [{"format": "cvssV3_1", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.7, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "Cisco", "product": "Cisco Identity Services Engine Software", "versions": [{"status": "affected", "version": "2.7.0"}, {"status": "affected", "version": "2.7.0 p1"}, {"status": "affected", "version": "2.7.0 p2"}, {"status": "affected", "version": "2.7.0 p3"}, {"status": "affected", "version": "2.7.0 p4"}, {"status": "affected", "version": "2.7.0 p5"}, {"status": "affected", "version": "2.7.0 p6"}, {"status": "affected", "version": "2.7.0 p7"}, {"status": "affected", "version": "2.7.0 p8"}, {"status": "affected", "version": "2.7.0 p9"}, {"status": "affected", "version": "2.7.0 p10"}, {"status": "affected", "version": "3.0.0"}, {"status": "affected", "version": "3.0.0 p1"}, {"status": "affected", "version": "3.0.0 p2"}, {"status": "affected", "version": "3.0.0 p3"}, {"status": "affected", "version": "3.0.0 p4"}, {"status": "affected", "version": "3.0.0 p5"}, {"status": "affected", "version": "3.0.0 p6"}, {"status": "affected", "version": "3.0.0 p7"}, {"status": "affected", "version": "3.0.0 p8"}, {"status": "affected", "version": "3.1.0"}, {"status": "affected", "version": "3.1.0 p1"}, {"status": "affected", "version": "3.1.0 p3"}, {"status": "affected", "version": "3.1.0 p2"}, {"status": "affected", "version": "3.1.0 p4"}, {"status": "affected", "version": "3.1.0 p5"}, {"status": "affected", "version": "3.1.0 p6"}, {"status": "affected", "version": "3.1.0 p7"}, {"status": "affected", "version": "3.1.0 p8"}, {"status": "affected", "version": "3.1.0 p9"}, {"status": "affected", "version": "3.2.0"}, {"status": "affected", "version": "3.2.0 p1"}, {"status": "affected", "version": "3.2.0 p2"}, {"status": "affected", "version": "3.2.0 p3"}, {"status": "affected", "version": "3.2.0 p4"}, {"status": "affected", "version": "3.2.0 p5"}, {"status": "affected", "version": "3.2.0 p6"}, {"status": "affected", "version": "3.3.0"}]}], "exploits": [{"lang": "en", "value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."}], "references": [{"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-file-upload-krW2TxA9", "name": "cisco-sa-ise-file-upload-krW2TxA9"}], "descriptions": [{"lang": "en", "value": "A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to upload arbitrary files to an affected device. To exploit this vulnerability, an attacker would need at least valid Policy Admin credentials on the affected device.\r\n\r This vulnerability is due to improper validation of files that are uploaded to the web-based management interface. An attacker could exploit this vulnerability by uploading arbitrary files to an affected device. A successful exploit could allow the attacker to store malicious files on the system, execute arbitrary commands on the operating system, and elevate privileges to root."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "cwe", "cweId": "CWE-434", "description": "Unrestricted Upload of File with Dangerous Type"}]}], "providerMetadata": {"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "shortName": "cisco", "dateUpdated": "2024-07-17T16:28:22.193Z"}}}, "cveMetadata": {"cveId": "CVE-2024-20296", "state": "PUBLISHED", "dateUpdated": "2024-08-01T21:59:41.103Z", "dateReserved": "2023-11-08T15:08:07.629Z", "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "datePublished": "2024-07-17T16:28:22.193Z", "assignerShortName": "cisco"}, "dataVersion": "5.1"}

{

dataType : CVE_RECORD (string)

containers : { »

adp : [ »

0 : { »

title : CVE Program Container (string)

references : [ »

0 : { »

url : https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-file-upload-krW2TxA9 (string)

name : cisco-sa-ise-file-upload-krW2TxA9 (string)

tags : [ »

0 : x_transferred (string)

]

}

]

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-01T21:59:41.103Z (string)

}

1 : { »

title : CISA ADP Vulnrichment (string)

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

id : CVE-2024-20296 (string)

role : CISA Coordinator (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : total (string)

}

]

version : 2.0.3 (string)

timestamp : 2024-07-17T21:12:19.717053Z (string)