CVE-2024-20486 - Vulnerability Details

Vendors	Products
Cisco	Identity Services Engine

Link	Providers
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-csrf-y4ZUz5Rj

Type	Values Removed	Values Added
First Time appeared		Cisco Cisco identity Services Engine
CPEs		cpe:2.3:a:cisco:identity_services_engine:::::::: cpe:2.3:a:cisco:identity_services_engine:3.1.0:-:::::: cpe:2.3:a:cisco:identity_services_engine:3.1.0:patch1:::::: cpe:2.3:a:cisco:identity_services_engine:3.1.0:patch2:::::: cpe:2.3:a:cisco:identity_services_engine:3.1.0:patch3:::::: cpe:2.3:a:cisco:identity_services_engine:3.1.0:patch4:::::: cpe:2.3:a:cisco:identity_services_engine:3.1.0:patch5:::::: cpe:2.3:a:cisco:identity_services_engine:3.1.0:patch6:::::: cpe:2.3:a:cisco:identity_services_engine:3.1.0:patch7:::::: cpe:2.3:a:cisco:identity_services_engine:3.1.0:patch8:::::: cpe:2.3:a:cisco:identity_services_engine:3.2.0:-:::::: cpe:2.3:a:cisco:identity_services_engine:3.2.0:patch1:::::: cpe:2.3:a:cisco:identity_services_engine:3.2.0:patch2:::::: cpe:2.3:a:cisco:identity_services_engine:3.2.0:patch3:::::: cpe:2.3:a:cisco:identity_services_engine:3.2.0:patch4:::::: cpe:2.3:a:cisco:identity_services_engine:3.2.0:patch5:::::: cpe:2.3:a:cisco:identity_services_engine:3.2.0:patch6:::::: cpe:2.3:a:cisco:identity_services_engine:3.3.0:-:::::: cpe:2.3:a:cisco:identity_services_engine:3.3.0:patch1:::::: cpe:2.3:a:cisco:identity_services_engine:3.3.0:patch2::::::
Vendors & Products		Cisco Cisco identity Services Engine

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Type	Values Removed	Values Added
Description		A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected device. This vulnerability is due to insufficient CSRF protections for the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to follow a crafted link. A successful exploit could allow the attacker to perform arbitrary actions on the affected device with the privileges of the targeted user.
Title		Cisco Identity Services Engine Cross-Site Request Forgery Vulnerability
Weaknesses		CWE-352
References		https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-csrf-y4ZUz5Rj
Metrics		cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N'}`

Show plain JSON

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-20486", "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "state": "PUBLISHED", "assignerShortName": "cisco", "dateReserved": "2023-11-08T15:08:07.685Z", "datePublished": "2024-08-21T19:16:29.014Z", "dateUpdated": "2024-08-21T19:53:51.297Z"}, "containers": {"cna": {"title": "Cisco Identity Services Engine Cross-Site Request Forgery Vulnerability", "metrics": [{"format": "cvssV3_1", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "baseScore": 6.5, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "availabilityImpact": "NONE"}}], "descriptions": [{"lang": "en", "value": "A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected device.\r\n\r\nThis vulnerability is due to insufficient CSRF protections for the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to follow a crafted link. A successful exploit could allow the attacker to perform arbitrary actions on the affected device with the privileges of the targeted user."}], "references": [{"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-csrf-y4ZUz5Rj", "name": "cisco-sa-ise-csrf-y4ZUz5Rj"}], "exploits": [{"lang": "en", "value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."}], "source": {"advisory": "cisco-sa-ise-csrf-y4ZUz5Rj", "discovery": "INTERNAL", "defects": ["CSCwj33460"]}, "problemTypes": [{"descriptions": [{"lang": "en", "description": "Cross-Site Request Forgery (CSRF)", "type": "cwe", "cweId": "CWE-352"}]}], "affected": [{"vendor": "Cisco", "product": "Cisco Identity Services Engine Software", "versions": [{"version": "2.7.0", "status": "affected"}, {"version": "2.7.0 p1", "status": "affected"}, {"version": "2.7.0 p2", "status": "affected"}, {"version": "3.0.0", "status": "affected"}, {"version": "3.0.0 p1", "status": "affected"}, {"version": "2.7.0 p3", "status": "affected"}, {"version": "3.0.0 p2", "status": "affected"}, {"version": "2.7.0 p4", "status": "affected"}, {"version": "3.0.0 p3", "status": "affected"}, {"version": "3.1.0", "status": "affected"}, {"version": "2.7.0 p5", "status": "affected"}, {"version": "3.0.0 p4", "status": "affected"}, {"version": "2.7.0 p6", "status": "affected"}, {"version": "3.1.0 p1", "status": "affected"}, {"version": "3.0.0 p5", "status": "affected"}, {"version": "2.7.0 p7", "status": "affected"}, {"version": "3.1.0 p3", "status": "affected"}, {"version": "3.1.0 p2", "status": "affected"}, {"version": "3.0.0 p6", "status": "affected"}, {"version": "3.2.0", "status": "affected"}, {"version": "3.1.0 p4", "status": "affected"}, {"version": "2.7.0 p8", "status": "affected"}, {"version": "3.1.0 p5", "status": "affected"}, {"version": "3.2.0 p1", "status": "affected"}, {"version": "2.7.0 p9", "status": "affected"}, {"version": "3.0.0 p7", "status": "affected"}, {"version": "3.1.0 p6", "status": "affected"}, {"version": "3.2.0 p2", "status": "affected"}, {"version": "3.1.0 p7", "status": "affected"}, {"version": "3.3.0", "status": "affected"}, {"version": "3.2.0 p3", "status": "affected"}, {"version": "3.0.0 p8", "status": "affected"}, {"version": "2.7.0 p10", "status": "affected"}, {"version": "3.2.0 p4", "status": "affected"}, {"version": "3.1.0 p8", "status": "affected"}, {"version": "3.2.0 p5", "status": "affected"}, {"version": "3.2.0 p6", "status": "affected"}, {"version": "3.3 Patch 2", "status": "affected"}, {"version": "3.3 Patch 1", "status": "affected"}, {"version": "3.3 Patch 3", "status": "affected"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "shortName": "cisco", "dateUpdated": "2024-08-21T19:16:29.014Z"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-08-21T19:53:34.953361Z", "id": "CVE-2024-20486", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-21T19:53:51.297Z"}}]}}

{

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

cveMetadata : { »

cveId : CVE-2024-20486 (string)

assignerOrgId : d1c1063e-7a18-46af-9102-31f8928bc633 (string)

state : PUBLISHED (string)

assignerShortName : cisco (string)

dateReserved : 2023-11-08T15:08:07.685Z (string)

datePublished : 2024-08-21T19:16:29.014Z (string)

dateUpdated : 2024-08-21T19:53:51.297Z (string)

}

containers : { »

cna : { »

title : Cisco Identity Services Engine Cross-Site Request Forgery Vulnerability (string)

metrics : [ »

0 : { »

format : cvssV3_1 (string)

cvssV3_1 : { »

version : 3.1 (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N (string)

baseScore : 6.5 (number)

baseSeverity : MEDIUM (string)

attackVector : NETWORK (string)

attackComplexity : LOW (string)

privilegesRequired : NONE (string)

userInteraction : REQUIRED (string)

scope : UNCHANGED (string)

confidentialityImpact : NONE (string)

integrityImpact : HIGH (string)

availabilityImpact : NONE (string)

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected device. This vulnerability is due to insufficient CSRF protections for the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to follow a crafted link. A successful exploit could allow the attacker to perform arbitrary actions on the affected device with the privileges of the targeted user. (string)

}

]

references : [ »

0 : { »

url : https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-csrf-y4ZUz5Rj (string)

name : cisco-sa-ise-csrf-y4ZUz5Rj (string)

}

]

exploits : [ »

0 : { »

lang : en (string)

value : The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory. (string)

}

]

source : { »

advisory : cisco-sa-ise-csrf-y4ZUz5Rj (string)

discovery : INTERNAL (string)

defects : [ »

0 : CSCwj33460 (string)

]

}

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

lang : en (string)

description : Cross-Site Request Forgery (CSRF) (string)

type : cwe (string)

cweId : CWE-352 (string)

}

]

}

]

affected : [ »

0 : { »

vendor : Cisco (string)

product : Cisco Identity Services Engine Software (string)

versions : [ »

0 : { »

version : 2.7.0 (string)

status : affected (string)

}

1 : { »

version : 2.7.0 p1 (string)

status : affected (string)

}

2 : { »

version : 2.7.0 p2 (string)

status : affected (string)

}

3 : { »

version : 3.0.0 (string)

status : affected (string)

}

4 : { »

version : 3.0.0 p1 (string)

status : affected (string)

}

5 : { »

version : 2.7.0 p3 (string)

status : affected (string)

}

6 : { »

version : 3.0.0 p2 (string)

status : affected (string)

}

7 : { »

version : 2.7.0 p4 (string)

status : affected (string)

}

8 : { »

version : 3.0.0 p3 (string)

status : affected (string)

}

9 : { »

version : 3.1.0 (string)

status : affected (string)

}

10 : { »

version : 2.7.0 p5 (string)

status : affected (string)

}

11 : { »

version : 3.0.0 p4 (string)

status : affected (string)

}

12 : { »

version : 2.7.0 p6 (string)

status : affected (string)

}

13 : { »

version : 3.1.0 p1 (string)

status : affected (string)

}

14 : { »

version : 3.0.0 p5 (string)

status : affected (string)

}

15 : { »

version : 2.7.0 p7 (string)

status : affected (string)

}

16 : { »

version : 3.1.0 p3 (string)

status : affected (string)

}

17 : { »

version : 3.1.0 p2 (string)

status : affected (string)

}

18 : { »

version : 3.0.0 p6 (string)

status : affected (string)

}

19 : { »

version : 3.2.0 (string)

status : affected (string)

}

20 : { »

version : 3.1.0 p4 (string)

status : affected (string)

}

21 : { »

version : 2.7.0 p8 (string)

status : affected (string)

}

22 : { »

version : 3.1.0 p5 (string)

status : affected (string)

}

23 : { »

version : 3.2.0 p1 (string)

status : affected (string)

}

24 : { »

version : 2.7.0 p9 (string)

status : affected (string)

}

25 : { »

version : 3.0.0 p7 (string)

status : affected (string)

}

26 : { »

version : 3.1.0 p6 (string)

status : affected (string)

}

27 : { »

version : 3.2.0 p2 (string)

status : affected (string)

}

28 : { »

version : 3.1.0 p7 (string)

status : affected (string)

}

29 : { »

version : 3.3.0 (string)

status : affected (string)

}

30 : { »

version : 3.2.0 p3 (string)

status : affected (string)

}

31 : { »

version : 3.0.0 p8 (string)

status : affected (string)

}

32 : { »

version : 2.7.0 p10 (string)

status : affected (string)

}

33 : { »

version : 3.2.0 p4 (string)

status : affected (string)

}

34 : { »

version : 3.1.0 p8 (string)

status : affected (string)

}

35 : { »

version : 3.2.0 p5 (string)

status : affected (string)

}

36 : { »

version : 3.2.0 p6 (string)

status : affected (string)

}

37 : { »

version : 3.3 Patch 2 (string)

status : affected (string)

}

38 : { »

version : 3.3 Patch 1 (string)

status : affected (string)

}

39 : { »

version : 3.3 Patch 3 (string)

status : affected (string)

}

]

defaultStatus : unknown (string)

}

]

providerMetadata : { »

orgId : d1c1063e-7a18-46af-9102-31f8928bc633 (string)

shortName : cisco (string)

dateUpdated : 2024-08-21T19:16:29.014Z (string)

}

adp : [ »

0 : { »

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

timestamp : 2024-08-21T19:53:34.953361Z (string)

id : CVE-2024-20486 (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : partial (string)

}

]

role : CISA Coordinator (string)

version : 2.0.3 (string)

}

]

title : CISA ADP Vulnrichment (string)

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2024-08-21T19:53:51.297Z (string)

}

]

}

Show plain JSON

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-20486", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-08-21T19:53:34.953361Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-21T19:53:46.306Z"}}], "cna": {"title": "Cisco Identity Services Engine Cross-Site Request Forgery Vulnerability", "source": {"defects": ["CSCwj33460"], "advisory": "cisco-sa-ise-csrf-y4ZUz5Rj", "discovery": "INTERNAL"}, "metrics": [{"format": "cvssV3_1", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "Cisco", "product": "Cisco Identity Services Engine Software", "versions": [{"status": "affected", "version": "2.7.0"}, {"status": "affected", "version": "2.7.0 p1"}, {"status": "affected", "version": "2.7.0 p2"}, {"status": "affected", "version": "3.0.0"}, {"status": "affected", "version": "3.0.0 p1"}, {"status": "affected", "version": "2.7.0 p3"}, {"status": "affected", "version": "3.0.0 p2"}, {"status": "affected", "version": "2.7.0 p4"}, {"status": "affected", "version": "3.0.0 p3"}, {"status": "affected", "version": "3.1.0"}, {"status": "affected", "version": "2.7.0 p5"}, {"status": "affected", "version": "3.0.0 p4"}, {"status": "affected", "version": "2.7.0 p6"}, {"status": "affected", "version": "3.1.0 p1"}, {"status": "affected", "version": "3.0.0 p5"}, {"status": "affected", "version": "2.7.0 p7"}, {"status": "affected", "version": "3.1.0 p3"}, {"status": "affected", "version": "3.1.0 p2"}, {"status": "affected", "version": "3.0.0 p6"}, {"status": "affected", "version": "3.2.0"}, {"status": "affected", "version": "3.1.0 p4"}, {"status": "affected", "version": "2.7.0 p8"}, {"status": "affected", "version": "3.1.0 p5"}, {"status": "affected", "version": "3.2.0 p1"}, {"status": "affected", "version": "2.7.0 p9"}, {"status": "affected", "version": "3.0.0 p7"}, {"status": "affected", "version": "3.1.0 p6"}, {"status": "affected", "version": "3.2.0 p2"}, {"status": "affected", "version": "3.1.0 p7"}, {"status": "affected", "version": "3.3.0"}, {"status": "affected", "version": "3.2.0 p3"}, {"status": "affected", "version": "3.0.0 p8"}, {"status": "affected", "version": "2.7.0 p10"}, {"status": "affected", "version": "3.2.0 p4"}, {"status": "affected", "version": "3.1.0 p8"}, {"status": "affected", "version": "3.2.0 p5"}, {"status": "affected", "version": "3.2.0 p6"}, {"status": "affected", "version": "3.3 Patch 2"}, {"status": "affected", "version": "3.3 Patch 1"}, {"status": "affected", "version": "3.3 Patch 3"}], "defaultStatus": "unknown"}], "exploits": [{"lang": "en", "value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."}], "references": [{"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-csrf-y4ZUz5Rj", "name": "cisco-sa-ise-csrf-y4ZUz5Rj"}], "descriptions": [{"lang": "en", "value": "A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected device.\r\n\r\nThis vulnerability is due to insufficient CSRF protections for the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to follow a crafted link. A successful exploit could allow the attacker to perform arbitrary actions on the affected device with the privileges of the targeted user."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "cwe", "cweId": "CWE-352", "description": "Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "shortName": "cisco", "dateUpdated": "2024-08-21T19:16:29.014Z"}}}, "cveMetadata": {"cveId": "CVE-2024-20486", "state": "PUBLISHED", "dateUpdated": "2024-08-21T19:53:51.297Z", "dateReserved": "2023-11-08T15:08:07.685Z", "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "datePublished": "2024-08-21T19:16:29.014Z", "assignerShortName": "cisco"}, "dataVersion": "5.1"}

{

dataType : CVE_RECORD (string)

containers : { »

adp : [ »

0 : { »

title : CISA ADP Vulnrichment (string)

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

id : CVE-2024-20486 (string)

role : CISA Coordinator (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : partial (string)

}

]

version : 2.0.3 (string)

timestamp : 2024-08-21T19:53:34.953361Z (string)

}

]

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2024-08-21T19:53:46.306Z (string)

}

]

cna : { »

title : Cisco Identity Services Engine Cross-Site Request Forgery Vulnerability (string)

source : { »

defects : [ »

0 : CSCwj33460 (string)

]

advisory : cisco-sa-ise-csrf-y4ZUz5Rj (string)

discovery : INTERNAL (string)

}

metrics : [ »

0 : { »

format : cvssV3_1 (string)

cvssV3_1 : { »

scope : UNCHANGED (string)

version : 3.1 (string)

baseScore : 6.5 (number)

attackVector : NETWORK (string)

baseSeverity : MEDIUM (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N (string)

integrityImpact : HIGH (string)

userInteraction : REQUIRED (string)

attackComplexity : LOW (string)

availabilityImpact : NONE (string)

privilegesRequired : NONE (string)

confidentialityImpact : NONE (string)

}

]

affected : [ »

0 : { »

vendor : Cisco (string)

product : Cisco Identity Services Engine Software (string)

versions : [ »

0 : { »

status : affected (string)

version : 2.7.0 (string)

}

1 : { »

status : affected (string)

version : 2.7.0 p1 (string)

}

2 : { »

status : affected (string)

version : 2.7.0 p2 (string)

}

3 : { »

status : affected (string)

version : 3.0.0 (string)

}

4 : { »

status : affected (string)

version : 3.0.0 p1 (string)

}

5 : { »

status : affected (string)

version : 2.7.0 p3 (string)

}

6 : { »

status : affected (string)

version : 3.0.0 p2 (string)

}

7 : { »

status : affected (string)

version : 2.7.0 p4 (string)

}

8 : { »

status : affected (string)

version : 3.0.0 p3 (string)

}

9 : { »

status : affected (string)

version : 3.1.0 (string)

}

10 : { »

status : affected (string)

version : 2.7.0 p5 (string)

}

11 : { »

status : affected (string)

version : 3.0.0 p4 (string)

}

12 : { »

status : affected (string)

version : 2.7.0 p6 (string)

}

13 : { »

status : affected (string)

version : 3.1.0 p1 (string)

}

14 : { »

status : affected (string)

version : 3.0.0 p5 (string)

}

15 : { »

status : affected (string)

version : 2.7.0 p7 (string)

}

16 : { »

status : affected (string)

version : 3.1.0 p3 (string)

}

17 : { »

status : affected (string)

version : 3.1.0 p2 (string)

}

18 : { »

status : affected (string)

version : 3.0.0 p6 (string)

}

19 : { »

status : affected (string)

version : 3.2.0 (string)

}

20 : { »

status : affected (string)

version : 3.1.0 p4 (string)

}

21 : { »

status : affected (string)

version : 2.7.0 p8 (string)

}

22 : { »

status : affected (string)

version : 3.1.0 p5 (string)

}

23 : { »

status : affected (string)

version : 3.2.0 p1 (string)

}

24 : { »

status : affected (string)

version : 2.7.0 p9 (string)

}

25 : { »

status : affected (string)

version : 3.0.0 p7 (string)

}

26 : { »

status : affected (string)

version : 3.1.0 p6 (string)

}

27 : { »

status : affected (string)

version : 3.2.0 p2 (string)

}

28 : { »

status : affected (string)

version : 3.1.0 p7 (string)

}

29 : { »

status : affected (string)

version : 3.3.0 (string)

}

30 : { »

status : affected (string)

version : 3.2.0 p3 (string)

}

31 : { »

status : affected (string)

version : 3.0.0 p8 (string)

}

32 : { »

status : affected (string)

version : 2.7.0 p10 (string)

}

33 : { »

status : affected (string)

version : 3.2.0 p4 (string)

}

34 : { »

status : affected (string)

version : 3.1.0 p8 (string)

}

35 : { »

status : affected (string)

version : 3.2.0 p5 (string)

}

36 : { »

status : affected (string)

version : 3.2.0 p6 (string)

}

37 : { »

status : affected (string)

version : 3.3 Patch 2 (string)

}

38 : { »

status : affected (string)

version : 3.3 Patch 1 (string)

}

39 : { »

status : affected (string)

version : 3.3 Patch 3 (string)

}

]

defaultStatus : unknown (string)

}

]

exploits : [ »

0 : { »

lang : en (string)

value : The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory. (string)

}

]

references : [ »

0 : { »

url : https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-csrf-y4ZUz5Rj (string)

name : cisco-sa-ise-csrf-y4ZUz5Rj (string)

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected device. This vulnerability is due to insufficient CSRF protections for the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to follow a crafted link. A successful exploit could allow the attacker to perform arbitrary actions on the affected device with the privileges of the targeted user. (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

lang : en (string)

type : cwe (string)

cweId : CWE-352 (string)

description : Cross-Site Request Forgery (CSRF) (string)

}

]

}

]

providerMetadata : { »

orgId : d1c1063e-7a18-46af-9102-31f8928bc633 (string)

shortName : cisco (string)

dateUpdated : 2024-08-21T19:16:29.014Z (string)

}

cveMetadata : { »

cveId : CVE-2024-20486 (string)

state : PUBLISHED (string)

dateUpdated : 2024-08-21T19:53:51.297Z (string)

dateReserved : 2023-11-08T15:08:07.685Z (string)

assignerOrgId : d1c1063e-7a18-46af-9102-31f8928bc633 (string)

datePublished : 2024-08-21T19:16:29.014Z (string)

assignerShortName : cisco (string)

}

dataVersion : 5.1 (string)

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:cisco:identity_services_engine:*:*:*:*:*:*:*:*", "matchCriteriaId": "CF37388F-EAC8-4206-A3AE-1C2E1AEFBE38", "versionEndExcluding": "3.1", "versionStartIncluding": "2.7.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:identity_services_engine:3.1.0:-:*:*:*:*:*:*", "matchCriteriaId": "7A789B44-7E6C-4FE9-BD40-702A871AB8AC", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:identity_services_engine:3.1.0:patch1:*:*:*:*:*:*", "matchCriteriaId": "93920663-445E-4456-A905-81CEC6CA1833", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:identity_services_engine:3.1.0:patch2:*:*:*:*:*:*", "matchCriteriaId": "33DA5BB8-4CFE-44BD-9CEB-BC26577E8477", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:identity_services_engine:3.1.0:patch3:*:*:*:*:*:*", "matchCriteriaId": "D3AEFA85-66B5-4145-A4AD-96D1FF86B46D", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:identity_services_engine:3.1.0:patch4:*:*:*:*:*:*", "matchCriteriaId": "7A6A0697-6A9E-48EF-82D8-36C75E0CDFDC", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:identity_services_engine:3.1.0:patch5:*:*:*:*:*:*", "matchCriteriaId": "E939B65A-7912-4C36-8799-03A1526D7BD3", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:identity_services_engine:3.1.0:patch6:*:*:*:*:*:*", "matchCriteriaId": "833B438F-0869-4C0D-9952-750C00702E8D", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:identity_services_engine:3.1.0:patch7:*:*:*:*:*:*", "matchCriteriaId": "E8B2588D-01F9-450B-B2E3-ADC4125E354E", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:identity_services_engine:3.1.0:patch8:*:*:*:*:*:*", "matchCriteriaId": "E41016C0-19E6-4BCC-A8DD-F6C9A2B0003E", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:identity_services_engine:3.2.0:-:*:*:*:*:*:*", "matchCriteriaId": "7932D5D5-83E1-4BEF-845A-D0783D4BB750", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:identity_services_engine:3.2.0:patch1:*:*:*:*:*:*", "matchCriteriaId": "1B818846-4A6E-4256-B344-281E8C786C43", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:identity_services_engine:3.2.0:patch2:*:*:*:*:*:*", "matchCriteriaId": "A44858A2-922A-425A-8B38-0C47DB911A3C", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:identity_services_engine:3.2.0:patch3:*:*:*:*:*:*", "matchCriteriaId": "53484A32-757B-42F8-B655-554C34222060", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:identity_services_engine:3.2.0:patch4:*:*:*:*:*:*", "matchCriteriaId": "0CCAC61F-C273-49B3-A631-31D3AE3EB148", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:identity_services_engine:3.2.0:patch5:*:*:*:*:*:*", "matchCriteriaId": "51AEFCE6-FB4A-4B1C-A23D-83CC3CF3FBBD", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:identity_services_engine:3.2.0:patch6:*:*:*:*:*:*", "matchCriteriaId": "B452B4F0-8510-475E-9AE8-B48FABB4D7D3", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:identity_services_engine:3.3.0:-:*:*:*:*:*:*", "matchCriteriaId": "F1B9C2C1-59A4-49A0-9B74-83CCB063E55D", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:identity_services_engine:3.3.0:patch1:*:*:*:*:*:*", "matchCriteriaId": "DFD29A0B-0D75-4EAB-BCE0-79450EC75DD0", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:identity_services_engine:3.3.0:patch2:*:*:*:*:*:*", "matchCriteriaId": "E6C94CC4-CC08-4DAF-A606-FDAFC92720A9", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected device.\r\n\r\nThis vulnerability is due to insufficient CSRF protections for the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to follow a crafted link. A successful exploit could allow the attacker to perform arbitrary actions on the affected device with the privileges of the targeted user."}, {"lang": "es", "value": "Una vulnerabilidad en la interfaz de administraci\u00f3n basada en web de Cisco Identity Services Engine (ISE) podr\u00eda permitir que un atacante remoto no autenticado lleve a cabo un ataque de cross-site request forgery (CSRF) y realice acciones arbitrarias en un dispositivo afectado. Esta vulnerabilidad se debe a protecciones CSRF insuficientes para la interfaz de administraci\u00f3n basada en web de un dispositivo afectado. Un atacante podr\u00eda aprovechar esta vulnerabilidad persuadiendo a un usuario de la interfaz para que siga un enlace manipulado. Un exploit exitoso podr\u00eda permitir al atacante realizar acciones arbitrarias en el dispositivo afectado con los privilegios del usuario objetivo."}], "id": "CVE-2024-20486", "lastModified": "2025-03-31T18:20:38.103", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "psirt@cisco.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2024-08-21T20:15:08.933", "references": [{"source": "psirt@cisco.com", "tags": ["Vendor Advisory"], "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-csrf-y4ZUz5Rj"}], "sourceIdentifier": "psirt@cisco.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "psirt@cisco.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-352"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:cisco:identity_services_engine:*:*:*:*:*:*:*:* (string)

matchCriteriaId : CF37388F-EAC8-4206-A3AE-1C2E1AEFBE38 (string)

versionEndExcluding : 3.1 (string)

versionStartIncluding : 2.7.0 (string)

vulnerable : true (boolean)

}

1 : { »

criteria : cpe:2.3:a:cisco:identity_services_engine:3.1.0:-:*:*:*:*:*:* (string)

matchCriteriaId : 7A789B44-7E6C-4FE9-BD40-702A871AB8AC (string)

vulnerable : true (boolean)

}

2 : { »

criteria : cpe:2.3:a:cisco:identity_services_engine:3.1.0:patch1:*:*:*:*:*:* (string)

matchCriteriaId : 93920663-445E-4456-A905-81CEC6CA1833 (string)

vulnerable : true (boolean)

}

3 : { »

criteria : cpe:2.3:a:cisco:identity_services_engine:3.1.0:patch2:*:*:*:*:*:* (string)

matchCriteriaId : 33DA5BB8-4CFE-44BD-9CEB-BC26577E8477 (string)

vulnerable : true (boolean)

}

4 : { »

criteria : cpe:2.3:a:cisco:identity_services_engine:3.1.0:patch3:*:*:*:*:*:* (string)

matchCriteriaId : D3AEFA85-66B5-4145-A4AD-96D1FF86B46D (string)

vulnerable : true (boolean)

}

5 : { »

criteria : cpe:2.3:a:cisco:identity_services_engine:3.1.0:patch4:*:*:*:*:*:* (string)

matchCriteriaId : 7A6A0697-6A9E-48EF-82D8-36C75E0CDFDC (string)

vulnerable : true (boolean)

}

6 : { »

criteria : cpe:2.3:a:cisco:identity_services_engine:3.1.0:patch5:*:*:*:*:*:* (string)

matchCriteriaId : E939B65A-7912-4C36-8799-03A1526D7BD3 (string)

vulnerable : true (boolean)

}

7 : { »

criteria : cpe:2.3:a:cisco:identity_services_engine:3.1.0:patch6:*:*:*:*:*:* (string)

matchCriteriaId : 833B438F-0869-4C0D-9952-750C00702E8D (string)

vulnerable : true (boolean)

}

8 : { »

criteria : cpe:2.3:a:cisco:identity_services_engine:3.1.0:patch7:*:*:*:*:*:* (string)

matchCriteriaId : E8B2588D-01F9-450B-B2E3-ADC4125E354E (string)

vulnerable : true (boolean)

}

9 : { »

criteria : cpe:2.3:a:cisco:identity_services_engine:3.1.0:patch8:*:*:*:*:*:* (string)

matchCriteriaId : E41016C0-19E6-4BCC-A8DD-F6C9A2B0003E (string)

vulnerable : true (boolean)

}

10 : { »

criteria : cpe:2.3:a:cisco:identity_services_engine:3.2.0:-:*:*:*:*:*:* (string)

matchCriteriaId : 7932D5D5-83E1-4BEF-845A-D0783D4BB750 (string)

vulnerable : true (boolean)

}

11 : { »

criteria : cpe:2.3:a:cisco:identity_services_engine:3.2.0:patch1:*:*:*:*:*:* (string)

matchCriteriaId : 1B818846-4A6E-4256-B344-281E8C786C43 (string)

vulnerable : true (boolean)

}

12 : { »

criteria : cpe:2.3:a:cisco:identity_services_engine:3.2.0:patch2:*:*:*:*:*:* (string)

matchCriteriaId : A44858A2-922A-425A-8B38-0C47DB911A3C (string)

vulnerable : true (boolean)

}

13 : { »

criteria : cpe:2.3:a:cisco:identity_services_engine:3.2.0:patch3:*:*:*:*:*:* (string)

matchCriteriaId : 53484A32-757B-42F8-B655-554C34222060 (string)

vulnerable : true (boolean)

}

14 : { »

criteria : cpe:2.3:a:cisco:identity_services_engine:3.2.0:patch4:*:*:*:*:*:* (string)

matchCriteriaId : 0CCAC61F-C273-49B3-A631-31D3AE3EB148 (string)

vulnerable : true (boolean)

}

15 : { »

criteria : cpe:2.3:a:cisco:identity_services_engine:3.2.0:patch5:*:*:*:*:*:* (string)

matchCriteriaId : 51AEFCE6-FB4A-4B1C-A23D-83CC3CF3FBBD (string)

vulnerable : true (boolean)

}

16 : { »

criteria : cpe:2.3:a:cisco:identity_services_engine:3.2.0:patch6:*:*:*:*:*:* (string)

matchCriteriaId : B452B4F0-8510-475E-9AE8-B48FABB4D7D3 (string)

vulnerable : true (boolean)

}

17 : { »

criteria : cpe:2.3:a:cisco:identity_services_engine:3.3.0:-:*:*:*:*:*:* (string)

matchCriteriaId : F1B9C2C1-59A4-49A0-9B74-83CCB063E55D (string)

vulnerable : true (boolean)

}

18 : { »

criteria : cpe:2.3:a:cisco:identity_services_engine:3.3.0:patch1:*:*:*:*:*:* (string)

matchCriteriaId : DFD29A0B-0D75-4EAB-BCE0-79450EC75DD0 (string)

vulnerable : true (boolean)

}

19 : { »

criteria : cpe:2.3:a:cisco:identity_services_engine:3.3.0:patch2:*:*:*:*:*:* (string)

matchCriteriaId : E6C94CC4-CC08-4DAF-A606-FDAFC92720A9 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

]

cveTags : [ *empty* ]

descriptions : [ »

0 : { »

lang : en (string)

value : A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected device. This vulnerability is due to insufficient CSRF protections for the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to follow a crafted link. A successful exploit could allow the attacker to perform arbitrary actions on the affected device with the privileges of the targeted user. (string)

}

1 : { »

lang : es (string)

value : Una vulnerabilidad en la interfaz de administración basada en web de Cisco Identity Services Engine (ISE) podría permitir que un atacante remoto no autenticado lleve a cabo un ataque de cross-site request forgery (CSRF) y realice acciones arbitrarias en un dispositivo afectado. Esta vulnerabilidad se debe a protecciones CSRF insuficientes para la interfaz de administración basada en web de un dispositivo afectado. Un atacante podría aprovechar esta vulnerabilidad persuadiendo a un usuario de la interfaz para que siga un enlace manipulado. Un exploit exitoso podría permitir al atacante realizar acciones arbitrarias en el dispositivo afectado con los privilegios del usuario objetivo. (string)

}

]

id : CVE-2024-20486 (string)

lastModified : 2025-03-31T18:20:38.103 (string)

metrics : { »

cvssMetricV31 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 6.5 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : NONE (string)

integrityImpact : HIGH (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : REQUIRED (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N (string)

version : 3.1 (string)

}

exploitabilityScore : 2.8 (number)

impactScore : 3.6 (number)

source : psirt@cisco.com (string)

type : Secondary (string)

}

1 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : HIGH (string)

baseScore : 8.8 (number)

baseSeverity : HIGH (string)

confidentialityImpact : HIGH (string)

integrityImpact : HIGH (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : REQUIRED (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (string)

version : 3.1 (string)

}

exploitabilityScore : 2.8 (number)

impactScore : 5.9 (number)

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

published : 2024-08-21T20:15:08.933 (string)

references : [ »

0 : { »

source : psirt@cisco.com (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-csrf-y4ZUz5Rj (string)

}

]

sourceIdentifier : psirt@cisco.com (string)

vulnStatus : Analyzed (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-352 (string)

}

]

source : psirt@cisco.com (string)

type : Secondary (string)

}

1 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-352 (string)

}

]

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact None

User Interaction Required

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact None

User Interaction Required

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object