csaf_ncscnl - ncsc-2024-0432

Vulnerability from csaf_ncscnl

Published

2024-11-07 08:55

Modified

2024-11-07 08:55

Summary

Kwetsbaarheden verholpen in Cisco Identity Services Engine

Notes

The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions: NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein. NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory. This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings.

Feiten

Cisco heeft kwetsbaarheden verholpen in Identity Services Engine (ISE)

Interpretaties

De kwetsbaarheden bevinden zich in de management-interface en stellen een kwaadwillende in staat om een Cross-Site-Scripting-aanval uit te voeren. Een dergelijke aanval kan leiden tot uitvoer van willekeurige code in de browser van het slachtoffer, of toegang tot gevoelige gegevens in de context van de browser van het slachtoffer. Omdat de kwetsbaarheden zich in de management-interface bevinden, is niet uit te sluiten dat het slachtoffer met verhoogde rechten werkt, waardoor uitvoer van code met verhoogde rechten kan plaatsvinden. Succesvol misbruik vereist wel dat de kwaadwillende toegang heeft tot de management-interface. Het is goed gebruik een dergelijke interface niet publiek toegankelijk te hebben, maar af te steunen in een separate beheer-omgeving.

Oplossingen

Cisco heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.

Kans

medium

Schade

high

CWE-863

Incorrect Authorization

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CWE-611

Improper Restriction of XML External Entity Reference

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

JSON

To clipboard

{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE"
      }
    },
    "lang": "nl",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n    NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n    NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n    This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings."
      },
      {
        "category": "description",
        "text": "Cisco heeft kwetsbaarheden verholpen in Identity Services Engine (ISE)",
        "title": "Feiten"
      },
      {
        "category": "description",
        "text": "De kwetsbaarheden bevinden zich in de management-interface en stellen een kwaadwillende in staat om een Cross-Site-Scripting-aanval uit te voeren. Een dergelijke aanval kan leiden tot uitvoer van willekeurige code in de browser van het slachtoffer, of toegang tot gevoelige gegevens in de context van de browser van het slachtoffer.\n\nOmdat de kwetsbaarheden zich in de management-interface bevinden, is niet uit te sluiten dat het slachtoffer met verhoogde rechten werkt, waardoor uitvoer van code met verhoogde rechten kan plaatsvinden.\n\nSuccesvol misbruik vereist wel dat de kwaadwillende toegang heeft tot de management-interface. Het is goed gebruik een dergelijke interface niet publiek toegankelijk te hebben, maar af te steunen in een separate beheer-omgeving.",
        "title": "Interpretaties"
      },
      {
        "category": "description",
        "text": "Cisco heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.",
        "title": "Oplossingen"
      },
      {
        "category": "general",
        "text": "medium",
        "title": "Kans"
      },
      {
        "category": "general",
        "text": "high",
        "title": "Schade"
      },
      {
        "category": "general",
        "text": "Incorrect Authorization",
        "title": "CWE-863"
      },
      {
        "category": "general",
        "text": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
        "title": "CWE-22"
      },
      {
        "category": "general",
        "text": "Improper Restriction of XML External Entity Reference",
        "title": "CWE-611"
      },
      {
        "category": "general",
        "text": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
        "title": "CWE-79"
      }
    ],
    "publisher": {
      "category": "coordinator",
      "contact_details": "cert@ncsc.nl",
      "name": "Nationaal Cyber Security Centrum",
      "namespace": "https://www.ncsc.nl/"
    },
    "references": [
      {
        "category": "external",
        "summary": "Source - cisco",
        "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-auth-bypass-BBRf7mkE"
      },
      {
        "category": "external",
        "summary": "Source - cisco",
        "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-multi-vuln-DBQdWRy"
      }
    ],
    "title": "Kwetsbaarheden verholpen in Cisco Identity Services Engine",
    "tracking": {
      "current_release_date": "2024-11-07T08:55:49.899244Z",
      "id": "NCSC-2024-0432",
      "initial_release_date": "2024-11-07T08:55:49.899244Z",
      "revision_history": [
        {
          "date": "2024-11-07T08:55:49.899244Z",
          "number": "0",
          "summary": "Initiele versie"
        }
      ],
      "status": "final",
      "version": "1.0.0"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_name",
            "name": "cisco_identity_services_engine_software",
            "product": {
              "name": "cisco_identity_services_engine_software",
              "product_id": "CSAFPID-1468261",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:cisco:cisco_identity_services_engine_software:3.0.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "cisco_identity_services_engine_software",
            "product": {
              "name": "cisco_identity_services_engine_software",
              "product_id": "CSAFPID-1468262",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:cisco:cisco_identity_services_engine_software:3.0.0_p1:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "cisco_identity_services_engine_software",
            "product": {
              "name": "cisco_identity_services_engine_software",
              "product_id": "CSAFPID-1468263",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:cisco:cisco_identity_services_engine_software:3.0.0_p2:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "cisco_identity_services_engine_software",
            "product": {
              "name": "cisco_identity_services_engine_software",
              "product_id": "CSAFPID-1468264",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:cisco:cisco_identity_services_engine_software:3.0.0_p3:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "cisco_identity_services_engine_software",
            "product": {
              "name": "cisco_identity_services_engine_software",
              "product_id": "CSAFPID-1468265",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:cisco:cisco_identity_services_engine_software:3.0.0_p4:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "cisco_identity_services_engine_software",
            "product": {
              "name": "cisco_identity_services_engine_software",
              "product_id": "CSAFPID-1468266",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:cisco:cisco_identity_services_engine_software:3.0.0_p5:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "cisco_identity_services_engine_software",
            "product": {
              "name": "cisco_identity_services_engine_software",
              "product_id": "CSAFPID-1468267",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:cisco:cisco_identity_services_engine_software:3.0.0_p6:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "cisco_identity_services_engine_software",
            "product": {
              "name": "cisco_identity_services_engine_software",
              "product_id": "CSAFPID-1468268",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:cisco:cisco_identity_services_engine_software:3.0.0_p7:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "cisco_identity_services_engine_software",
            "product": {
              "name": "cisco_identity_services_engine_software",
              "product_id": "CSAFPID-1468269",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:cisco:cisco_identity_services_engine_software:3.0.0_p8:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "cisco_identity_services_engine_software",
            "product": {
              "name": "cisco_identity_services_engine_software",
              "product_id": "CSAFPID-1468270",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:cisco:cisco_identity_services_engine_software:3.1.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "cisco_identity_services_engine_software",
            "product": {
              "name": "cisco_identity_services_engine_software",
              "product_id": "CSAFPID-1468271",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:cisco:cisco_identity_services_engine_software:3.1.0_p1:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "cisco_identity_services_engine_software",
            "product": {
              "name": "cisco_identity_services_engine_software",
              "product_id": "CSAFPID-1468273",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:cisco:cisco_identity_services_engine_software:3.1.0_p2:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "cisco_identity_services_engine_software",
            "product": {
              "name": "cisco_identity_services_engine_software",
              "product_id": "CSAFPID-1468272",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:cisco:cisco_identity_services_engine_software:3.1.0_p3:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "cisco_identity_services_engine_software",
            "product": {
              "name": "cisco_identity_services_engine_software",
              "product_id": "CSAFPID-1468274",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:cisco:cisco_identity_services_engine_software:3.1.0_p4:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "cisco_identity_services_engine_software",
            "product": {
              "name": "cisco_identity_services_engine_software",
              "product_id": "CSAFPID-1468275",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:cisco:cisco_identity_services_engine_software:3.1.0_p5:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "cisco_identity_services_engine_software",
            "product": {
              "name": "cisco_identity_services_engine_software",
              "product_id": "CSAFPID-1468276",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:cisco:cisco_identity_services_engine_software:3.1.0_p6:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "cisco_identity_services_engine_software",
            "product": {
              "name": "cisco_identity_services_engine_software",
              "product_id": "CSAFPID-1468277",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:cisco:cisco_identity_services_engine_software:3.1.0_p7:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "cisco_identity_services_engine_software",
            "product": {
              "name": "cisco_identity_services_engine_software",
              "product_id": "CSAFPID-1468278",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:cisco:cisco_identity_services_engine_software:3.1.0_p8:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "cisco_identity_services_engine_software",
            "product": {
              "name": "cisco_identity_services_engine_software",
              "product_id": "CSAFPID-1504660",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:cisco:cisco_identity_services_engine_software:3.1.0_p9:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "cisco_identity_services_engine_software",
            "product": {
              "name": "cisco_identity_services_engine_software",
              "product_id": "CSAFPID-1467861",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:cisco:cisco_identity_services_engine_software:3.2.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "cisco_identity_services_engine_software",
            "product": {
              "name": "cisco_identity_services_engine_software",
              "product_id": "CSAFPID-1467862",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:cisco:cisco_identity_services_engine_software:3.2.0_p1:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "cisco_identity_services_engine_software",
            "product": {
              "name": "cisco_identity_services_engine_software",
              "product_id": "CSAFPID-1467863",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:cisco:cisco_identity_services_engine_software:3.2.0_p2:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "cisco_identity_services_engine_software",
            "product": {
              "name": "cisco_identity_services_engine_software",
              "product_id": "CSAFPID-1467864",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:cisco:cisco_identity_services_engine_software:3.2.0_p3:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "cisco_identity_services_engine_software",
            "product": {
              "name": "cisco_identity_services_engine_software",
              "product_id": "CSAFPID-1467865",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:cisco:cisco_identity_services_engine_software:3.2.0_p4:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "cisco_identity_services_engine_software",
            "product": {
              "name": "cisco_identity_services_engine_software",
              "product_id": "CSAFPID-1504661",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:cisco:cisco_identity_services_engine_software:3.2.0_p5:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "cisco_identity_services_engine_software",
            "product": {
              "name": "cisco_identity_services_engine_software",
              "product_id": "CSAFPID-1504662",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:cisco:cisco_identity_services_engine_software:3.2.0_p6:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "cisco_identity_services_engine_software",
            "product": {
              "name": "cisco_identity_services_engine_software",
              "product_id": "CSAFPID-1467866",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:cisco:cisco_identity_services_engine_software:3.3.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "cisco_identity_services_engine_software",
            "product": {
              "name": "cisco_identity_services_engine_software",
              "product_id": "CSAFPID-1610415",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:cisco:cisco_identity_services_engine_software:3.3_patch_1:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "cisco_identity_services_engine_software",
            "product": {
              "name": "cisco_identity_services_engine_software",
              "product_id": "CSAFPID-1610414",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:cisco:cisco_identity_services_engine_software:3.3_patch_2:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "cisco_identity_services_engine_software",
            "product": {
              "name": "cisco_identity_services_engine_software",
              "product_id": "CSAFPID-1621400",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:cisco:cisco_identity_services_engine_software:3.3_patch_3:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "cisco_identity_services_engine_software",
            "product": {
              "name": "cisco_identity_services_engine_software",
              "product_id": "CSAFPID-1660265",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:cisco:cisco_identity_services_engine_software:3.4.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "identity_services_engine",
            "product": {
              "name": "identity_services_engine",
              "product_id": "CSAFPID-54153",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:cisco:identity_services_engine:*:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "identity_services_engine",
            "product": {
              "name": "identity_services_engine",
              "product_id": "CSAFPID-318305",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:cisco:identity_services_engine:3.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "identity_services_engine",
            "product": {
              "name": "identity_services_engine",
              "product_id": "CSAFPID-1504966",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:cisco:identity_services_engine:3.0:p1:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "identity_services_engine",
            "product": {
              "name": "identity_services_engine",
              "product_id": "CSAFPID-1504947",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:cisco:identity_services_engine:3.0:p2:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "identity_services_engine",
            "product": {
              "name": "identity_services_engine",
              "product_id": "CSAFPID-1504949",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:cisco:identity_services_engine:3.0:p3:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "identity_services_engine",
            "product": {
              "name": "identity_services_engine",
              "product_id": "CSAFPID-1504956",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:cisco:identity_services_engine:3.0:p4:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "identity_services_engine",
            "product": {
              "name": "identity_services_engine",
              "product_id": "CSAFPID-1504952",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:cisco:identity_services_engine:3.0:p5:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "identity_services_engine",
            "product": {
              "name": "identity_services_engine",
              "product_id": "CSAFPID-1504964",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:cisco:identity_services_engine:3.0:p6:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "identity_services_engine",
            "product": {
              "name": "identity_services_engine",
              "product_id": "CSAFPID-1504957",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:cisco:identity_services_engine:3.0:p7:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "identity_services_engine",
            "product": {
              "name": "identity_services_engine",
              "product_id": "CSAFPID-1504970",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:cisco:identity_services_engine:3.0:p8:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "identity_services_engine",
            "product": {
              "name": "identity_services_engine",
              "product_id": "CSAFPID-1504946",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:cisco:identity_services_engine:3.1.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "identity_services_engine",
            "product": {
              "name": "identity_services_engine",
              "product_id": "CSAFPID-1504948",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:cisco:identity_services_engine:3.1.0:p1:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "identity_services_engine",
            "product": {
              "name": "identity_services_engine",
              "product_id": "CSAFPID-1504951",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:cisco:identity_services_engine:3.1.0:p2:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "identity_services_engine",
            "product": {
              "name": "identity_services_engine",
              "product_id": "CSAFPID-1504945",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:cisco:identity_services_engine:3.1.0:p3:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "identity_services_engine",
            "product": {
              "name": "identity_services_engine",
              "product_id": "CSAFPID-1504943",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:cisco:identity_services_engine:3.1.0:p4:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "identity_services_engine",
            "product": {
              "name": "identity_services_engine",
              "product_id": "CSAFPID-1504971",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:cisco:identity_services_engine:3.1.0:p5:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "identity_services_engine",
            "product": {
              "name": "identity_services_engine",
              "product_id": "CSAFPID-1504972",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:cisco:identity_services_engine:3.1.0:p6:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "identity_services_engine",
            "product": {
              "name": "identity_services_engine",
              "product_id": "CSAFPID-1504973",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:cisco:identity_services_engine:3.1.0:p7:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "identity_services_engine",
            "product": {
              "name": "identity_services_engine",
              "product_id": "CSAFPID-1504976",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:cisco:identity_services_engine:3.1.0:p8:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "identity_services_engine",
            "product": {
              "name": "identity_services_engine",
              "product_id": "CSAFPID-1504974",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:cisco:identity_services_engine:3.1.0:p9:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "identity_services_engine",
            "product": {
              "name": "identity_services_engine",
              "product_id": "CSAFPID-1504944",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:cisco:identity_services_engine:3.2.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "identity_services_engine",
            "product": {
              "name": "identity_services_engine",
              "product_id": "CSAFPID-1504967",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:cisco:identity_services_engine:3.2.0:p1:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "identity_services_engine",
            "product": {
              "name": "identity_services_engine",
              "product_id": "CSAFPID-1504962",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:cisco:identity_services_engine:3.2.0:p2:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "identity_services_engine",
            "product": {
              "name": "identity_services_engine",
              "product_id": "CSAFPID-1504958",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:cisco:identity_services_engine:3.2.0:p3:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "identity_services_engine",
            "product": {
              "name": "identity_services_engine",
              "product_id": "CSAFPID-1504961",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:cisco:identity_services_engine:3.2.0:p4:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "identity_services_engine",
            "product": {
              "name": "identity_services_engine",
              "product_id": "CSAFPID-1504955",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:cisco:identity_services_engine:3.2.0:p5:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "identity_services_engine",
            "product": {
              "name": "identity_services_engine",
              "product_id": "CSAFPID-1504963",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:cisco:identity_services_engine:3.2.0:p6:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "identity_services_engine",
            "product": {
              "name": "identity_services_engine",
              "product_id": "CSAFPID-1504977",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:cisco:identity_services_engine:3.3.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "identity_services_engine",
            "product": {
              "name": "identity_services_engine",
              "product_id": "CSAFPID-515300",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:cisco:identity_services_engine:3.3:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "identity_services_engine",
            "product": {
              "name": "identity_services_engine",
              "product_id": "CSAFPID-1610128",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:cisco:identity_services_engine:3.3:p1:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "identity_services_engine",
            "product": {
              "name": "identity_services_engine",
              "product_id": "CSAFPID-1610129",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:cisco:identity_services_engine:3.3:p2:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "identity_services_engine",
            "product": {
              "name": "identity_services_engine",
              "product_id": "CSAFPID-1623027",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:cisco:identity_services_engine:3.3:p3:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "identity_services_engine",
            "product": {
              "name": "identity_services_engine",
              "product_id": "CSAFPID-1660337",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:cisco:identity_services_engine:3.4.0:*:*:*:*:*:*:*"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "cisco"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-20525",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
          "title": "CWE-22"
        },
        {
          "category": "other",
          "text": "Improper Restriction of XML External Entity Reference",
          "title": "CWE-611"
        },
        {
          "category": "other",
          "text": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
          "title": "CWE-79"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1468275",
          "CSAFPID-1660265",
          "CSAFPID-1467866",
          "CSAFPID-1468269",
          "CSAFPID-1467861",
          "CSAFPID-1468267",
          "CSAFPID-1468274",
          "CSAFPID-1621400",
          "CSAFPID-1468265",
          "CSAFPID-1468263",
          "CSAFPID-1468261",
          "CSAFPID-1468272",
          "CSAFPID-1468264",
          "CSAFPID-1504661",
          "CSAFPID-1467862",
          "CSAFPID-1468277",
          "CSAFPID-1504660",
          "CSAFPID-1468271",
          "CSAFPID-1467865",
          "CSAFPID-1610415",
          "CSAFPID-1468276",
          "CSAFPID-1504662",
          "CSAFPID-1468266",
          "CSAFPID-1610414",
          "CSAFPID-1468273",
          "CSAFPID-1467864",
          "CSAFPID-1468270",
          "CSAFPID-1468268",
          "CSAFPID-1467863",
          "CSAFPID-1468278",
          "CSAFPID-1468262",
          "CSAFPID-1504948",
          "CSAFPID-1504951",
          "CSAFPID-1504945",
          "CSAFPID-1504943",
          "CSAFPID-1504971",
          "CSAFPID-1504972",
          "CSAFPID-1504973",
          "CSAFPID-1504976",
          "CSAFPID-1504967",
          "CSAFPID-1504962",
          "CSAFPID-1504958",
          "CSAFPID-1504961",
          "CSAFPID-1504955",
          "CSAFPID-1504963"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-20525",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-20525.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1468275",
            "CSAFPID-1660265",
            "CSAFPID-1467866",
            "CSAFPID-1468269",
            "CSAFPID-1467861",
            "CSAFPID-1468267",
            "CSAFPID-1468274",
            "CSAFPID-1621400",
            "CSAFPID-1468265",
            "CSAFPID-1468263",
            "CSAFPID-1468261",
            "CSAFPID-1468272",
            "CSAFPID-1468264",
            "CSAFPID-1504661",
            "CSAFPID-1467862",
            "CSAFPID-1468277",
            "CSAFPID-1504660",
            "CSAFPID-1468271",
            "CSAFPID-1467865",
            "CSAFPID-1610415",
            "CSAFPID-1468276",
            "CSAFPID-1504662",
            "CSAFPID-1468266",
            "CSAFPID-1610414",
            "CSAFPID-1468273",
            "CSAFPID-1467864",
            "CSAFPID-1468270",
            "CSAFPID-1468268",
            "CSAFPID-1467863",
            "CSAFPID-1468278",
            "CSAFPID-1468262",
            "CSAFPID-1504948",
            "CSAFPID-1504951",
            "CSAFPID-1504945",
            "CSAFPID-1504943",
            "CSAFPID-1504971",
            "CSAFPID-1504972",
            "CSAFPID-1504973",
            "CSAFPID-1504976",
            "CSAFPID-1504967",
            "CSAFPID-1504962",
            "CSAFPID-1504958",
            "CSAFPID-1504961",
            "CSAFPID-1504955",
            "CSAFPID-1504963"
          ]
        }
      ],
      "title": "CVE-2024-20525"
    },
    {
      "cve": "CVE-2024-20527",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
          "title": "CWE-22"
        },
        {
          "category": "other",
          "text": "Improper Restriction of XML External Entity Reference",
          "title": "CWE-611"
        },
        {
          "category": "other",
          "text": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
          "title": "CWE-79"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1468275",
          "CSAFPID-1660265",
          "CSAFPID-1467866",
          "CSAFPID-1468269",
          "CSAFPID-1467861",
          "CSAFPID-1468267",
          "CSAFPID-1468274",
          "CSAFPID-1621400",
          "CSAFPID-1468265",
          "CSAFPID-1468263",
          "CSAFPID-1468261",
          "CSAFPID-1468272",
          "CSAFPID-1468264",
          "CSAFPID-1504661",
          "CSAFPID-1467862",
          "CSAFPID-1468277",
          "CSAFPID-1504660",
          "CSAFPID-1468271",
          "CSAFPID-1467865",
          "CSAFPID-1610415",
          "CSAFPID-1468276",
          "CSAFPID-1504662",
          "CSAFPID-1468266",
          "CSAFPID-1610414",
          "CSAFPID-1468273",
          "CSAFPID-1467864",
          "CSAFPID-1468270",
          "CSAFPID-1468268",
          "CSAFPID-1467863",
          "CSAFPID-1468278",
          "CSAFPID-1468262",
          "CSAFPID-54153",
          "CSAFPID-1504943",
          "CSAFPID-1504945",
          "CSAFPID-1504948",
          "CSAFPID-1504951",
          "CSAFPID-1504955",
          "CSAFPID-1504958",
          "CSAFPID-1504961",
          "CSAFPID-1504962",
          "CSAFPID-1504963",
          "CSAFPID-1504967",
          "CSAFPID-1504971",
          "CSAFPID-1504972",
          "CSAFPID-1504973",
          "CSAFPID-1504976"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-20527",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-20527.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1468275",
            "CSAFPID-1660265",
            "CSAFPID-1467866",
            "CSAFPID-1468269",
            "CSAFPID-1467861",
            "CSAFPID-1468267",
            "CSAFPID-1468274",
            "CSAFPID-1621400",
            "CSAFPID-1468265",
            "CSAFPID-1468263",
            "CSAFPID-1468261",
            "CSAFPID-1468272",
            "CSAFPID-1468264",
            "CSAFPID-1504661",
            "CSAFPID-1467862",
            "CSAFPID-1468277",
            "CSAFPID-1504660",
            "CSAFPID-1468271",
            "CSAFPID-1467865",
            "CSAFPID-1610415",
            "CSAFPID-1468276",
            "CSAFPID-1504662",
            "CSAFPID-1468266",
            "CSAFPID-1610414",
            "CSAFPID-1468273",
            "CSAFPID-1467864",
            "CSAFPID-1468270",
            "CSAFPID-1468268",
            "CSAFPID-1467863",
            "CSAFPID-1468278",
            "CSAFPID-1468262",
            "CSAFPID-54153",
            "CSAFPID-1504943",
            "CSAFPID-1504945",
            "CSAFPID-1504948",
            "CSAFPID-1504951",
            "CSAFPID-1504955",
            "CSAFPID-1504958",
            "CSAFPID-1504961",
            "CSAFPID-1504962",
            "CSAFPID-1504963",
            "CSAFPID-1504967",
            "CSAFPID-1504971",
            "CSAFPID-1504972",
            "CSAFPID-1504973",
            "CSAFPID-1504976"
          ]
        }
      ],
      "title": "CVE-2024-20527"
    },
    {
      "cve": "CVE-2024-20529",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
          "title": "CWE-22"
        },
        {
          "category": "other",
          "text": "Improper Restriction of XML External Entity Reference",
          "title": "CWE-611"
        },
        {
          "category": "other",
          "text": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
          "title": "CWE-79"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1468275",
          "CSAFPID-1467866",
          "CSAFPID-1467861",
          "CSAFPID-1468274",
          "CSAFPID-1621400",
          "CSAFPID-1468272",
          "CSAFPID-1504661",
          "CSAFPID-1467862",
          "CSAFPID-1468277",
          "CSAFPID-1504660",
          "CSAFPID-1468271",
          "CSAFPID-1467865",
          "CSAFPID-1610415",
          "CSAFPID-1468276",
          "CSAFPID-1504662",
          "CSAFPID-1610414",
          "CSAFPID-1468273",
          "CSAFPID-1467864",
          "CSAFPID-1468270",
          "CSAFPID-1467863",
          "CSAFPID-1468278",
          "CSAFPID-1504958",
          "CSAFPID-1504961",
          "CSAFPID-1504962",
          "CSAFPID-1504963",
          "CSAFPID-1504967",
          "CSAFPID-1504971",
          "CSAFPID-1504972",
          "CSAFPID-1504943",
          "CSAFPID-1504973",
          "CSAFPID-1504945",
          "CSAFPID-1504948",
          "CSAFPID-1504951",
          "CSAFPID-1504976",
          "CSAFPID-1504955"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-20529",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-20529.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1468275",
            "CSAFPID-1467866",
            "CSAFPID-1467861",
            "CSAFPID-1468274",
            "CSAFPID-1621400",
            "CSAFPID-1468272",
            "CSAFPID-1504661",
            "CSAFPID-1467862",
            "CSAFPID-1468277",
            "CSAFPID-1504660",
            "CSAFPID-1468271",
            "CSAFPID-1467865",
            "CSAFPID-1610415",
            "CSAFPID-1468276",
            "CSAFPID-1504662",
            "CSAFPID-1610414",
            "CSAFPID-1468273",
            "CSAFPID-1467864",
            "CSAFPID-1468270",
            "CSAFPID-1467863",
            "CSAFPID-1468278",
            "CSAFPID-1504958",
            "CSAFPID-1504961",
            "CSAFPID-1504962",
            "CSAFPID-1504963",
            "CSAFPID-1504967",
            "CSAFPID-1504971",
            "CSAFPID-1504972",
            "CSAFPID-1504943",
            "CSAFPID-1504973",
            "CSAFPID-1504945",
            "CSAFPID-1504948",
            "CSAFPID-1504951",
            "CSAFPID-1504976",
            "CSAFPID-1504955"
          ]
        }
      ],
      "title": "CVE-2024-20529"
    },
    {
      "cve": "CVE-2024-20530",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
          "title": "CWE-22"
        },
        {
          "category": "other",
          "text": "Improper Restriction of XML External Entity Reference",
          "title": "CWE-611"
        },
        {
          "category": "other",
          "text": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
          "title": "CWE-79"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1468275",
          "CSAFPID-1660265",
          "CSAFPID-1467866",
          "CSAFPID-1468269",
          "CSAFPID-1467861",
          "CSAFPID-1468267",
          "CSAFPID-1468274",
          "CSAFPID-1621400",
          "CSAFPID-1468265",
          "CSAFPID-1468263",
          "CSAFPID-1468261",
          "CSAFPID-1468272",
          "CSAFPID-1468264",
          "CSAFPID-1504661",
          "CSAFPID-1467862",
          "CSAFPID-1468277",
          "CSAFPID-1504660",
          "CSAFPID-1468271",
          "CSAFPID-1467865",
          "CSAFPID-1610415",
          "CSAFPID-1468276",
          "CSAFPID-1504662",
          "CSAFPID-1468266",
          "CSAFPID-1610414",
          "CSAFPID-1468273",
          "CSAFPID-1467864",
          "CSAFPID-1468270",
          "CSAFPID-1468268",
          "CSAFPID-1467863",
          "CSAFPID-1468278",
          "CSAFPID-1468262",
          "CSAFPID-1504943",
          "CSAFPID-1504945",
          "CSAFPID-1504948",
          "CSAFPID-1504951",
          "CSAFPID-1504955",
          "CSAFPID-1504958",
          "CSAFPID-1504961",
          "CSAFPID-1504962",
          "CSAFPID-1504963",
          "CSAFPID-1504967",
          "CSAFPID-1504971",
          "CSAFPID-1504972",
          "CSAFPID-1504973",
          "CSAFPID-1504976",
          "CSAFPID-54153"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-20530",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-20530.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1468275",
            "CSAFPID-1660265",
            "CSAFPID-1467866",
            "CSAFPID-1468269",
            "CSAFPID-1467861",
            "CSAFPID-1468267",
            "CSAFPID-1468274",
            "CSAFPID-1621400",
            "CSAFPID-1468265",
            "CSAFPID-1468263",
            "CSAFPID-1468261",
            "CSAFPID-1468272",
            "CSAFPID-1468264",
            "CSAFPID-1504661",
            "CSAFPID-1467862",
            "CSAFPID-1468277",
            "CSAFPID-1504660",
            "CSAFPID-1468271",
            "CSAFPID-1467865",
            "CSAFPID-1610415",
            "CSAFPID-1468276",
            "CSAFPID-1504662",
            "CSAFPID-1468266",
            "CSAFPID-1610414",
            "CSAFPID-1468273",
            "CSAFPID-1467864",
            "CSAFPID-1468270",
            "CSAFPID-1468268",
            "CSAFPID-1467863",
            "CSAFPID-1468278",
            "CSAFPID-1468262",
            "CSAFPID-1504943",
            "CSAFPID-1504945",
            "CSAFPID-1504948",
            "CSAFPID-1504951",
            "CSAFPID-1504955",
            "CSAFPID-1504958",
            "CSAFPID-1504961",
            "CSAFPID-1504962",
            "CSAFPID-1504963",
            "CSAFPID-1504967",
            "CSAFPID-1504971",
            "CSAFPID-1504972",
            "CSAFPID-1504973",
            "CSAFPID-1504976",
            "CSAFPID-54153"
          ]
        }
      ],
      "title": "CVE-2024-20530"
    },
    {
      "cve": "CVE-2024-20531",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
          "title": "CWE-22"
        },
        {
          "category": "other",
          "text": "Improper Restriction of XML External Entity Reference",
          "title": "CWE-611"
        },
        {
          "category": "other",
          "text": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
          "title": "CWE-79"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1468275",
          "CSAFPID-1660265",
          "CSAFPID-1467866",
          "CSAFPID-1468269",
          "CSAFPID-1467861",
          "CSAFPID-1468267",
          "CSAFPID-1468274",
          "CSAFPID-1621400",
          "CSAFPID-1468265",
          "CSAFPID-1468263",
          "CSAFPID-1468261",
          "CSAFPID-1468272",
          "CSAFPID-1468264",
          "CSAFPID-1504661",
          "CSAFPID-1467862",
          "CSAFPID-1468277",
          "CSAFPID-1504660",
          "CSAFPID-1468271",
          "CSAFPID-1467865",
          "CSAFPID-1610415",
          "CSAFPID-1468276",
          "CSAFPID-1504662",
          "CSAFPID-1468266",
          "CSAFPID-1610414",
          "CSAFPID-1468273",
          "CSAFPID-1467864",
          "CSAFPID-1468270",
          "CSAFPID-1468268",
          "CSAFPID-1467863",
          "CSAFPID-1468278",
          "CSAFPID-1468262",
          "CSAFPID-1504943",
          "CSAFPID-1504945",
          "CSAFPID-1504948",
          "CSAFPID-1504951",
          "CSAFPID-1504955",
          "CSAFPID-1504958",
          "CSAFPID-1504961",
          "CSAFPID-1504962",
          "CSAFPID-1504963",
          "CSAFPID-1504967",
          "CSAFPID-1504971",
          "CSAFPID-1504972",
          "CSAFPID-1504973",
          "CSAFPID-1504976"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-20531",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-20531.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1468275",
            "CSAFPID-1660265",
            "CSAFPID-1467866",
            "CSAFPID-1468269",
            "CSAFPID-1467861",
            "CSAFPID-1468267",
            "CSAFPID-1468274",
            "CSAFPID-1621400",
            "CSAFPID-1468265",
            "CSAFPID-1468263",
            "CSAFPID-1468261",
            "CSAFPID-1468272",
            "CSAFPID-1468264",
            "CSAFPID-1504661",
            "CSAFPID-1467862",
            "CSAFPID-1468277",
            "CSAFPID-1504660",
            "CSAFPID-1468271",
            "CSAFPID-1467865",
            "CSAFPID-1610415",
            "CSAFPID-1468276",
            "CSAFPID-1504662",
            "CSAFPID-1468266",
            "CSAFPID-1610414",
            "CSAFPID-1468273",
            "CSAFPID-1467864",
            "CSAFPID-1468270",
            "CSAFPID-1468268",
            "CSAFPID-1467863",
            "CSAFPID-1468278",
            "CSAFPID-1468262",
            "CSAFPID-1504943",
            "CSAFPID-1504945",
            "CSAFPID-1504948",
            "CSAFPID-1504951",
            "CSAFPID-1504955",
            "CSAFPID-1504958",
            "CSAFPID-1504961",
            "CSAFPID-1504962",
            "CSAFPID-1504963",
            "CSAFPID-1504967",
            "CSAFPID-1504971",
            "CSAFPID-1504972",
            "CSAFPID-1504973",
            "CSAFPID-1504976"
          ]
        }
      ],
      "title": "CVE-2024-20531"
    },
    {
      "cve": "CVE-2024-20532",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
          "title": "CWE-22"
        },
        {
          "category": "other",
          "text": "Improper Restriction of XML External Entity Reference",
          "title": "CWE-611"
        },
        {
          "category": "other",
          "text": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
          "title": "CWE-79"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1468275",
          "CSAFPID-1660265",
          "CSAFPID-1467866",
          "CSAFPID-1468269",
          "CSAFPID-1467861",
          "CSAFPID-1468267",
          "CSAFPID-1468274",
          "CSAFPID-1621400",
          "CSAFPID-1468265",
          "CSAFPID-1468263",
          "CSAFPID-1468261",
          "CSAFPID-1468272",
          "CSAFPID-1468264",
          "CSAFPID-1504661",
          "CSAFPID-1467862",
          "CSAFPID-1468277",
          "CSAFPID-1504660",
          "CSAFPID-1468271",
          "CSAFPID-1467865",
          "CSAFPID-1610415",
          "CSAFPID-1468276",
          "CSAFPID-1504662",
          "CSAFPID-1468266",
          "CSAFPID-1610414",
          "CSAFPID-1468273",
          "CSAFPID-1467864",
          "CSAFPID-1468270",
          "CSAFPID-1468268",
          "CSAFPID-1467863",
          "CSAFPID-1468278",
          "CSAFPID-1468262",
          "CSAFPID-54153",
          "CSAFPID-1504943",
          "CSAFPID-1504945",
          "CSAFPID-1504948",
          "CSAFPID-1504951",
          "CSAFPID-1504955",
          "CSAFPID-1504958",
          "CSAFPID-1504961",
          "CSAFPID-1504962",
          "CSAFPID-1504963",
          "CSAFPID-1504967",
          "CSAFPID-1504971",
          "CSAFPID-1504972",
          "CSAFPID-1504973",
          "CSAFPID-1504976"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-20532",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-20532.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1468275",
            "CSAFPID-1660265",
            "CSAFPID-1467866",
            "CSAFPID-1468269",
            "CSAFPID-1467861",
            "CSAFPID-1468267",
            "CSAFPID-1468274",
            "CSAFPID-1621400",
            "CSAFPID-1468265",
            "CSAFPID-1468263",
            "CSAFPID-1468261",
            "CSAFPID-1468272",
            "CSAFPID-1468264",
            "CSAFPID-1504661",
            "CSAFPID-1467862",
            "CSAFPID-1468277",
            "CSAFPID-1504660",
            "CSAFPID-1468271",
            "CSAFPID-1467865",
            "CSAFPID-1610415",
            "CSAFPID-1468276",
            "CSAFPID-1504662",
            "CSAFPID-1468266",
            "CSAFPID-1610414",
            "CSAFPID-1468273",
            "CSAFPID-1467864",
            "CSAFPID-1468270",
            "CSAFPID-1468268",
            "CSAFPID-1467863",
            "CSAFPID-1468278",
            "CSAFPID-1468262",
            "CSAFPID-54153",
            "CSAFPID-1504943",
            "CSAFPID-1504945",
            "CSAFPID-1504948",
            "CSAFPID-1504951",
            "CSAFPID-1504955",
            "CSAFPID-1504958",
            "CSAFPID-1504961",
            "CSAFPID-1504962",
            "CSAFPID-1504963",
            "CSAFPID-1504967",
            "CSAFPID-1504971",
            "CSAFPID-1504972",
            "CSAFPID-1504973",
            "CSAFPID-1504976"
          ]
        }
      ],
      "title": "CVE-2024-20532"
    },
    {
      "cve": "CVE-2024-20537",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
          "title": "CWE-79"
        },
        {
          "category": "other",
          "text": "Incorrect Authorization",
          "title": "CWE-863"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1468275",
          "CSAFPID-1467866",
          "CSAFPID-1468269",
          "CSAFPID-1467861",
          "CSAFPID-1468267",
          "CSAFPID-1468274",
          "CSAFPID-1468265",
          "CSAFPID-1468263",
          "CSAFPID-1468261",
          "CSAFPID-1468272",
          "CSAFPID-1468264",
          "CSAFPID-1504661",
          "CSAFPID-1467862",
          "CSAFPID-1468277",
          "CSAFPID-1504660",
          "CSAFPID-1468271",
          "CSAFPID-1467865",
          "CSAFPID-1610415",
          "CSAFPID-1468276",
          "CSAFPID-1504662",
          "CSAFPID-1468266",
          "CSAFPID-1610414",
          "CSAFPID-1468273",
          "CSAFPID-1467864",
          "CSAFPID-1468270",
          "CSAFPID-1468268",
          "CSAFPID-1467863",
          "CSAFPID-1468278",
          "CSAFPID-1468262",
          "CSAFPID-1504943",
          "CSAFPID-1504945",
          "CSAFPID-1504948",
          "CSAFPID-1504951",
          "CSAFPID-1504955",
          "CSAFPID-1504958",
          "CSAFPID-1504961",
          "CSAFPID-1504962",
          "CSAFPID-1504963",
          "CSAFPID-1504967",
          "CSAFPID-1504971",
          "CSAFPID-1504972",
          "CSAFPID-1504973",
          "CSAFPID-1504976"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-20537",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-20537.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1468275",
            "CSAFPID-1467866",
            "CSAFPID-1468269",
            "CSAFPID-1467861",
            "CSAFPID-1468267",
            "CSAFPID-1468274",
            "CSAFPID-1468265",
            "CSAFPID-1468263",
            "CSAFPID-1468261",
            "CSAFPID-1468272",
            "CSAFPID-1468264",
            "CSAFPID-1504661",
            "CSAFPID-1467862",
            "CSAFPID-1468277",
            "CSAFPID-1504660",
            "CSAFPID-1468271",
            "CSAFPID-1467865",
            "CSAFPID-1610415",
            "CSAFPID-1468276",
            "CSAFPID-1504662",
            "CSAFPID-1468266",
            "CSAFPID-1610414",
            "CSAFPID-1468273",
            "CSAFPID-1467864",
            "CSAFPID-1468270",
            "CSAFPID-1468268",
            "CSAFPID-1467863",
            "CSAFPID-1468278",
            "CSAFPID-1468262",
            "CSAFPID-1504943",
            "CSAFPID-1504945",
            "CSAFPID-1504948",
            "CSAFPID-1504951",
            "CSAFPID-1504955",
            "CSAFPID-1504958",
            "CSAFPID-1504961",
            "CSAFPID-1504962",
            "CSAFPID-1504963",
            "CSAFPID-1504967",
            "CSAFPID-1504971",
            "CSAFPID-1504972",
            "CSAFPID-1504973",
            "CSAFPID-1504976"
          ]
        }
      ],
      "title": "CVE-2024-20537"
    },
    {
      "cve": "CVE-2024-20538",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
          "title": "CWE-79"
        },
        {
          "category": "other",
          "text": "Incorrect Authorization",
          "title": "CWE-863"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1468275",
          "CSAFPID-1467866",
          "CSAFPID-1468269",
          "CSAFPID-1467861",
          "CSAFPID-1468267",
          "CSAFPID-1468274",
          "CSAFPID-1621400",
          "CSAFPID-1468265",
          "CSAFPID-1468263",
          "CSAFPID-1468261",
          "CSAFPID-1468272",
          "CSAFPID-1468264",
          "CSAFPID-1504661",
          "CSAFPID-1467862",
          "CSAFPID-1468277",
          "CSAFPID-1504660",
          "CSAFPID-1468271",
          "CSAFPID-1467865",
          "CSAFPID-1610415",
          "CSAFPID-1468276",
          "CSAFPID-1504662",
          "CSAFPID-1468266",
          "CSAFPID-1610414",
          "CSAFPID-1468273",
          "CSAFPID-1467864",
          "CSAFPID-1468270",
          "CSAFPID-1468268",
          "CSAFPID-1467863",
          "CSAFPID-1468278",
          "CSAFPID-1468262",
          "CSAFPID-1504943",
          "CSAFPID-1504945",
          "CSAFPID-1504948",
          "CSAFPID-1504951",
          "CSAFPID-1504955",
          "CSAFPID-1504958",
          "CSAFPID-1504961",
          "CSAFPID-1504962",
          "CSAFPID-1504963",
          "CSAFPID-1504967",
          "CSAFPID-1504971",
          "CSAFPID-1504972",
          "CSAFPID-1504973",
          "CSAFPID-1504976"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-20538",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-20538.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1468275",
            "CSAFPID-1467866",
            "CSAFPID-1468269",
            "CSAFPID-1467861",
            "CSAFPID-1468267",
            "CSAFPID-1468274",
            "CSAFPID-1621400",
            "CSAFPID-1468265",
            "CSAFPID-1468263",
            "CSAFPID-1468261",
            "CSAFPID-1468272",
            "CSAFPID-1468264",
            "CSAFPID-1504661",
            "CSAFPID-1467862",
            "CSAFPID-1468277",
            "CSAFPID-1504660",
            "CSAFPID-1468271",
            "CSAFPID-1467865",
            "CSAFPID-1610415",
            "CSAFPID-1468276",
            "CSAFPID-1504662",
            "CSAFPID-1468266",
            "CSAFPID-1610414",
            "CSAFPID-1468273",
            "CSAFPID-1467864",
            "CSAFPID-1468270",
            "CSAFPID-1468268",
            "CSAFPID-1467863",
            "CSAFPID-1468278",
            "CSAFPID-1468262",
            "CSAFPID-1504943",
            "CSAFPID-1504945",
            "CSAFPID-1504948",
            "CSAFPID-1504951",
            "CSAFPID-1504955",
            "CSAFPID-1504958",
            "CSAFPID-1504961",
            "CSAFPID-1504962",
            "CSAFPID-1504963",
            "CSAFPID-1504967",
            "CSAFPID-1504971",
            "CSAFPID-1504972",
            "CSAFPID-1504973",
            "CSAFPID-1504976"
          ]
        }
      ],
      "title": "CVE-2024-20538"
    }
  ]
}

cve-2024-20525

Vulnerability from cvelistv5

Published

2024-11-06 16:30

Modified

2024-11-06 17:04

Severity ?

6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Summary

A vulnerability in the web-based management interface of Cisco ISE could allow an unauthenticated, remote attacker to conduct an XSS attack against a user of the interface. This vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.

References

▼	URL	Tags
	https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-multi-vuln-DBQdWRy

Impacted products

Vendor

Product

Version

▼

Cisco

Cisco Identity Services Engine Software

Version: 3.0.0
Version: 3.0.0 p1
Version: 3.0.0 p2
Version: 3.0.0 p3
Version: 3.1.0
Version: 3.0.0 p4
Version: 3.1.0 p1
Version: 3.0.0 p5
Version: 3.1.0 p3
Version: 3.1.0 p2
Version: 3.0.0 p6
Version: 3.2.0
Version: 3.1.0 p4
Version: 3.1.0 p5
Version: 3.2.0 p1
Version: 3.0.0 p7
Version: 3.1.0 p6
Version: 3.2.0 p2
Version: 3.1.0 p7
Version: 3.3.0
Version: 3.2.0 p3
Version: 3.0.0 p8
Version: 3.2.0 p4
Version: 3.1.0 p8
Version: 3.2.0 p5
Version: 3.2.0 p6
Version: 3.1.0 p9
Version: 3.3 Patch 2
Version: 3.3 Patch 1
Version: 3.3 Patch 3
Version: 3.4.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-20525",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-06T17:03:56.791336Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-06T17:04:04.858Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Cisco Identity Services Engine Software",
          "vendor": "Cisco",
          "versions": [
            {
              "status": "affected",
              "version": "3.0.0"
            },
            {
              "status": "affected",
              "version": "3.0.0 p1"
            },
            {
              "status": "affected",
              "version": "3.0.0 p2"
            },
            {
              "status": "affected",
              "version": "3.0.0 p3"
            },
            {
              "status": "affected",
              "version": "3.1.0"
            },
            {
              "status": "affected",
              "version": "3.0.0 p4"
            },
            {
              "status": "affected",
              "version": "3.1.0 p1"
            },
            {
              "status": "affected",
              "version": "3.0.0 p5"
            },
            {
              "status": "affected",
              "version": "3.1.0 p3"
            },
            {
              "status": "affected",
              "version": "3.1.0 p2"
            },
            {
              "status": "affected",
              "version": "3.0.0 p6"
            },
            {
              "status": "affected",
              "version": "3.2.0"
            },
            {
              "status": "affected",
              "version": "3.1.0 p4"
            },
            {
              "status": "affected",
              "version": "3.1.0 p5"
            },
            {
              "status": "affected",
              "version": "3.2.0 p1"
            },
            {
              "status": "affected",
              "version": "3.0.0 p7"
            },
            {
              "status": "affected",
              "version": "3.1.0 p6"
            },
            {
              "status": "affected",
              "version": "3.2.0 p2"
            },
            {
              "status": "affected",
              "version": "3.1.0 p7"
            },
            {
              "status": "affected",
              "version": "3.3.0"
            },
            {
              "status": "affected",
              "version": "3.2.0 p3"
            },
            {
              "status": "affected",
              "version": "3.0.0 p8"
            },
            {
              "status": "affected",
              "version": "3.2.0 p4"
            },
            {
              "status": "affected",
              "version": "3.1.0 p8"
            },
            {
              "status": "affected",
              "version": "3.2.0 p5"
            },
            {
              "status": "affected",
              "version": "3.2.0 p6"
            },
            {
              "status": "affected",
              "version": "3.1.0 p9"
            },
            {
              "status": "affected",
              "version": "3.3 Patch 2"
            },
            {
              "status": "affected",
              "version": "3.3 Patch 1"
            },
            {
              "status": "affected",
              "version": "3.3 Patch 3"
            },
            {
              "status": "affected",
              "version": "3.4.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability in the web-based management interface of Cisco ISE could allow an unauthenticated, remote attacker to conduct an XSS attack against a user of the interface.\r\n\r\nThis vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "cvssV3_1"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "cwe"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-11-06T16:30:13.693Z",
        "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
        "shortName": "cisco"
      },
      "references": [
        {
          "name": "cisco-sa-ise-multi-vuln-DBQdWRy",
          "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-multi-vuln-DBQdWRy"
        }
      ],
      "source": {
        "advisory": "cisco-sa-ise-multi-vuln-DBQdWRy",
        "defects": [
          "CSCwk47423"
        ],
        "discovery": "INTERNAL"
      },
      "title": "Cisco Identity Services Engine Reflected Cross-Site Scripting Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
    "assignerShortName": "cisco",
    "cveId": "CVE-2024-20525",
    "datePublished": "2024-11-06T16:30:13.693Z",
    "dateReserved": "2023-11-08T15:08:07.691Z",
    "dateUpdated": "2024-11-06T17:04:04.858Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2024-20538

Vulnerability from cvelistv5

Published

2024-11-06 16:31

Modified

2024-11-06 16:58

Severity ?

6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Summary

A vulnerability in the web-based management interface of Cisco ISE could allow an unauthenticated, remote attacker to conduct an XSS attack against a user of the interface. This vulnerability exists because the web-based management interface does not sufficiently validate user-supplied input. An attacker could exploit this vulnerability by persuading a user of the interface on an affected system to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.

References

▼	URL	Tags
	https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-auth-bypass-BBRf7mkE

Impacted products

Vendor

Product

Version

▼

Cisco

Cisco Identity Services Engine Software

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-20538",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-06T16:58:50.799840Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-06T16:58:58.730Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Cisco Identity Services Engine Software",
          "vendor": "Cisco",
          "versions": [
            {
              "status": "affected",
              "version": "3.0.0"
            },
            {
              "status": "affected",
              "version": "3.0.0 p1"
            },
            {
              "status": "affected",
              "version": "3.0.0 p2"
            },
            {
              "status": "affected",
              "version": "3.0.0 p3"
            },
            {
              "status": "affected",
              "version": "3.1.0"
            },
            {
              "status": "affected",
              "version": "3.0.0 p4"
            },
            {
              "status": "affected",
              "version": "3.1.0 p1"
            },
            {
              "status": "affected",
              "version": "3.0.0 p5"
            },
            {
              "status": "affected",
              "version": "3.1.0 p3"
            },
            {
              "status": "affected",
              "version": "3.1.0 p2"
            },
            {
              "status": "affected",
              "version": "3.0.0 p6"
            },
            {
              "status": "affected",
              "version": "3.2.0"
            },
            {
              "status": "affected",
              "version": "3.1.0 p4"
            },
            {
              "status": "affected",
              "version": "3.1.0 p5"
            },
            {
              "status": "affected",
              "version": "3.2.0 p1"
            },
            {
              "status": "affected",
              "version": "3.0.0 p7"
            },
            {
              "status": "affected",
              "version": "3.1.0 p6"
            },
            {
              "status": "affected",
              "version": "3.2.0 p2"
            },
            {
              "status": "affected",
              "version": "3.1.0 p7"
            },
            {
              "status": "affected",
              "version": "3.3.0"
            },
            {
              "status": "affected",
              "version": "3.2.0 p3"
            },
            {
              "status": "affected",
              "version": "3.0.0 p8"
            },
            {
              "status": "affected",
              "version": "3.2.0 p4"
            },
            {
              "status": "affected",
              "version": "3.1.0 p8"
            },
            {
              "status": "affected",
              "version": "3.2.0 p5"
            },
            {
              "status": "affected",
              "version": "3.2.0 p6"
            },
            {
              "status": "affected",
              "version": "3.1.0 p9"
            },
            {
              "status": "affected",
              "version": "3.3 Patch 2"
            },
            {
              "status": "affected",
              "version": "3.3 Patch 1"
            },
            {
              "status": "affected",
              "version": "3.3 Patch 3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability in the web-based management interface of Cisco ISE could allow an unauthenticated, remote attacker to conduct an XSS attack against a user of the interface.\r\n\r\nThis vulnerability exists because the web-based management interface does not sufficiently validate user-supplied input. An attacker could exploit this vulnerability by persuading a user of the interface on an affected system to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "cvssV3_1"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "cwe"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-11-06T16:31:55.462Z",
        "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
        "shortName": "cisco"
      },
      "references": [
        {
          "name": "cisco-sa-ise-auth-bypass-BBRf7mkE",
          "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-auth-bypass-BBRf7mkE"
        }
      ],
      "source": {
        "advisory": "cisco-sa-ise-auth-bypass-BBRf7mkE",
        "defects": [
          "CSCwj96002"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Cisco Identity Services Engine Cross-Site Scripting Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
    "assignerShortName": "cisco",
    "cveId": "CVE-2024-20538",
    "datePublished": "2024-11-06T16:31:55.462Z",
    "dateReserved": "2023-11-08T15:08:07.693Z",
    "dateUpdated": "2024-11-06T16:58:58.730Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2024-20532

Vulnerability from cvelistv5

Published

2024-11-06 16:31

Modified

2024-11-06 17:01

Severity ?

5.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N

Summary

A vulnerability in the API of Cisco ISE could allow an authenticated, remote attacker to read and delete arbitrary files on an affected device. To exploit this vulnerability, the attacker would need valid Super Admin credentials. This vulnerability is due to insufficient validation of user-supplied parameters in API requests. An attacker could exploit this vulnerability by sending a crafted API request to an affected device. A successful exploit could allow the attacker to read or delete arbitrary files on the underlying operating system.

References

▼	URL	Tags
	https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-multi-vuln-DBQdWRy

Impacted products

Vendor

Product

Version

▼

Cisco

Cisco Identity Services Engine Software

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-20532",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-06T17:01:08.649213Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-06T17:01:20.345Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Cisco Identity Services Engine Software",
          "vendor": "Cisco",
          "versions": [
            {
              "status": "affected",
              "version": "3.0.0"
            },
            {
              "status": "affected",
              "version": "3.0.0 p1"
            },
            {
              "status": "affected",
              "version": "3.0.0 p2"
            },
            {
              "status": "affected",
              "version": "3.0.0 p3"
            },
            {
              "status": "affected",
              "version": "3.1.0"
            },
            {
              "status": "affected",
              "version": "3.0.0 p4"
            },
            {
              "status": "affected",
              "version": "3.1.0 p1"
            },
            {
              "status": "affected",
              "version": "3.0.0 p5"
            },
            {
              "status": "affected",
              "version": "3.1.0 p3"
            },
            {
              "status": "affected",
              "version": "3.1.0 p2"
            },
            {
              "status": "affected",
              "version": "3.0.0 p6"
            },
            {
              "status": "affected",
              "version": "3.2.0"
            },
            {
              "status": "affected",
              "version": "3.1.0 p4"
            },
            {
              "status": "affected",
              "version": "3.1.0 p5"
            },
            {
              "status": "affected",
              "version": "3.2.0 p1"
            },
            {
              "status": "affected",
              "version": "3.0.0 p7"
            },
            {
              "status": "affected",
              "version": "3.1.0 p6"
            },
            {
              "status": "affected",
              "version": "3.2.0 p2"
            },
            {
              "status": "affected",
              "version": "3.1.0 p7"
            },
            {
              "status": "affected",
              "version": "3.3.0"
            },
            {
              "status": "affected",
              "version": "3.2.0 p3"
            },
            {
              "status": "affected",
              "version": "3.0.0 p8"
            },
            {
              "status": "affected",
              "version": "3.2.0 p4"
            },
            {
              "status": "affected",
              "version": "3.1.0 p8"
            },
            {
              "status": "affected",
              "version": "3.2.0 p5"
            },
            {
              "status": "affected",
              "version": "3.2.0 p6"
            },
            {
              "status": "affected",
              "version": "3.1.0 p9"
            },
            {
              "status": "affected",
              "version": "3.3 Patch 2"
            },
            {
              "status": "affected",
              "version": "3.3 Patch 1"
            },
            {
              "status": "affected",
              "version": "3.3 Patch 3"
            },
            {
              "status": "affected",
              "version": "3.4.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability in the API of Cisco ISE could allow an authenticated, remote attacker to read and delete arbitrary files on an affected device. To exploit this vulnerability, the attacker would need valid Super Admin credentials.\r\n\r\nThis vulnerability is due to insufficient validation of user-supplied parameters in API requests. An attacker could exploit this vulnerability by sending a crafted API request to an affected device. A successful exploit could allow the attacker to read or delete arbitrary files on the underlying operating system."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N",
            "version": "3.1"
          },
          "format": "cvssV3_1"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "cwe"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-11-06T16:31:12.867Z",
        "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
        "shortName": "cisco"
      },
      "references": [
        {
          "name": "cisco-sa-ise-multi-vuln-DBQdWRy",
          "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-multi-vuln-DBQdWRy"
        }
      ],
      "source": {
        "advisory": "cisco-sa-ise-multi-vuln-DBQdWRy",
        "defects": [
          "CSCwk47475"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Cisco Identity Services Engine Arbitrary File Read and Delete Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
    "assignerShortName": "cisco",
    "cveId": "CVE-2024-20532",
    "datePublished": "2024-11-06T16:31:12.867Z",
    "dateReserved": "2023-11-08T15:08:07.692Z",
    "dateUpdated": "2024-11-06T17:01:20.345Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2024-20531

Vulnerability from cvelistv5

Published

2024-11-06 16:31

Modified

2024-11-06 17:01

Severity ?

5.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N

Summary

A vulnerability in the API of Cisco ISE could allow an authenticated, remote attacker to read arbitrary files on the underlying operating system of an affected device and conduct a server-side request forgery (SSRF) attack through an affected device. To exploit this vulnerability, the attacker would need valid Super Admin credentials. This vulnerability is due to improper handling of XML External Entity (XXE) entries when parsing XML input. An attacker could exploit this vulnerability by sending a crafted API request to an affected device. A successful exploit could allow the attacker to read arbitrary files on the underlying operating system or conduct an SSRF attack through the affected device.

References

▼	URL	Tags
	https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-multi-vuln-DBQdWRy

Impacted products

Vendor

Product

Version

▼

Cisco

Cisco Identity Services Engine Software

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-20531",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-06T17:01:40.966247Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-06T17:01:49.705Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Cisco Identity Services Engine Software",
          "vendor": "Cisco",
          "versions": [
            {
              "status": "affected",
              "version": "3.0.0"
            },
            {
              "status": "affected",
              "version": "3.0.0 p1"
            },
            {
              "status": "affected",
              "version": "3.0.0 p2"
            },
            {
              "status": "affected",
              "version": "3.0.0 p3"
            },
            {
              "status": "affected",
              "version": "3.1.0"
            },
            {
              "status": "affected",
              "version": "3.0.0 p4"
            },
            {
              "status": "affected",
              "version": "3.1.0 p1"
            },
            {
              "status": "affected",
              "version": "3.0.0 p5"
            },
            {
              "status": "affected",
              "version": "3.1.0 p3"
            },
            {
              "status": "affected",
              "version": "3.1.0 p2"
            },
            {
              "status": "affected",
              "version": "3.0.0 p6"
            },
            {
              "status": "affected",
              "version": "3.2.0"
            },
            {
              "status": "affected",
              "version": "3.1.0 p4"
            },
            {
              "status": "affected",
              "version": "3.1.0 p5"
            },
            {
              "status": "affected",
              "version": "3.2.0 p1"
            },
            {
              "status": "affected",
              "version": "3.0.0 p7"
            },
            {
              "status": "affected",
              "version": "3.1.0 p6"
            },
            {
              "status": "affected",
              "version": "3.2.0 p2"
            },
            {
              "status": "affected",
              "version": "3.1.0 p7"
            },
            {
              "status": "affected",
              "version": "3.3.0"
            },
            {
              "status": "affected",
              "version": "3.2.0 p3"
            },
            {
              "status": "affected",
              "version": "3.0.0 p8"
            },
            {
              "status": "affected",
              "version": "3.2.0 p4"
            },
            {
              "status": "affected",
              "version": "3.1.0 p8"
            },
            {
              "status": "affected",
              "version": "3.2.0 p5"
            },
            {
              "status": "affected",
              "version": "3.2.0 p6"
            },
            {
              "status": "affected",
              "version": "3.1.0 p9"
            },
            {
              "status": "affected",
              "version": "3.3 Patch 2"
            },
            {
              "status": "affected",
              "version": "3.3 Patch 1"
            },
            {
              "status": "affected",
              "version": "3.3 Patch 3"
            },
            {
              "status": "affected",
              "version": "3.4.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability in the API of Cisco ISE could allow an authenticated, remote attacker to read arbitrary files on the underlying operating system of an affected device and conduct a server-side request forgery (SSRF) attack through an affected device. To exploit this vulnerability, the attacker would need valid Super Admin credentials.\r\n\r\nThis vulnerability is due to improper handling of XML External Entity (XXE) entries when parsing XML input. An attacker could exploit this vulnerability by sending a crafted API request to an affected device. A successful exploit could allow the attacker to read arbitrary files on the underlying operating system or conduct an SSRF attack through the affected device."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "cvssV3_1"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-611",
              "description": "Improper Restriction of XML External Entity Reference",
              "lang": "en",
              "type": "cwe"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-11-06T16:31:04.087Z",
        "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
        "shortName": "cisco"
      },
      "references": [
        {
          "name": "cisco-sa-ise-multi-vuln-DBQdWRy",
          "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-multi-vuln-DBQdWRy"
        }
      ],
      "source": {
        "advisory": "cisco-sa-ise-multi-vuln-DBQdWRy",
        "defects": [
          "CSCwk47465"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Cisco Identity Services Engine XML External Entity Injection Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
    "assignerShortName": "cisco",
    "cveId": "CVE-2024-20531",
    "datePublished": "2024-11-06T16:31:04.087Z",
    "dateReserved": "2023-11-08T15:08:07.692Z",
    "dateUpdated": "2024-11-06T17:01:49.705Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2024-20537

Vulnerability from cvelistv5

Published

2024-11-06 16:31

Modified

2024-11-06 16:59

Severity ?

6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Summary

A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to bypass the authorization mechanisms for specific administrative functions. This vulnerability is due to a lack of server-side validation of Administrator permissions. An attacker could exploit this vulnerability by submitting a crafted HTTP request to an affected system. A successful exploit could allow the attacker to conduct administrative functions beyond their intended access level. To exploit this vulnerability, an attacker would need Read-Only Administrator credentials.

References

▼	URL	Tags
	https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-auth-bypass-BBRf7mkE

Impacted products

Vendor

Product

Version

▼

Cisco

Cisco Identity Services Engine Software

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-20537",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-06T16:59:20.295927Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-06T16:59:39.975Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Cisco Identity Services Engine Software",
          "vendor": "Cisco",
          "versions": [
            {
              "status": "affected",
              "version": "3.0.0"
            },
            {
              "status": "affected",
              "version": "3.0.0 p1"
            },
            {
              "status": "affected",
              "version": "3.0.0 p2"
            },
            {
              "status": "affected",
              "version": "3.0.0 p3"
            },
            {
              "status": "affected",
              "version": "3.1.0"
            },
            {
              "status": "affected",
              "version": "3.0.0 p4"
            },
            {
              "status": "affected",
              "version": "3.1.0 p1"
            },
            {
              "status": "affected",
              "version": "3.0.0 p5"
            },
            {
              "status": "affected",
              "version": "3.1.0 p3"
            },
            {
              "status": "affected",
              "version": "3.1.0 p2"
            },
            {
              "status": "affected",
              "version": "3.0.0 p6"
            },
            {
              "status": "affected",
              "version": "3.2.0"
            },
            {
              "status": "affected",
              "version": "3.1.0 p4"
            },
            {
              "status": "affected",
              "version": "3.1.0 p5"
            },
            {
              "status": "affected",
              "version": "3.2.0 p1"
            },
            {
              "status": "affected",
              "version": "3.0.0 p7"
            },
            {
              "status": "affected",
              "version": "3.1.0 p6"
            },
            {
              "status": "affected",
              "version": "3.2.0 p2"
            },
            {
              "status": "affected",
              "version": "3.1.0 p7"
            },
            {
              "status": "affected",
              "version": "3.3.0"
            },
            {
              "status": "affected",
              "version": "3.2.0 p3"
            },
            {
              "status": "affected",
              "version": "3.0.0 p8"
            },
            {
              "status": "affected",
              "version": "3.2.0 p4"
            },
            {
              "status": "affected",
              "version": "3.1.0 p8"
            },
            {
              "status": "affected",
              "version": "3.2.0 p5"
            },
            {
              "status": "affected",
              "version": "3.2.0 p6"
            },
            {
              "status": "affected",
              "version": "3.1.0 p9"
            },
            {
              "status": "affected",
              "version": "3.3 Patch 2"
            },
            {
              "status": "affected",
              "version": "3.3 Patch 1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to bypass the authorization mechanisms for specific administrative functions.\r\n\r\nThis vulnerability is due to a lack of server-side validation of Administrator permissions. An attacker could exploit this vulnerability by submitting a crafted HTTP request to an affected system. A successful exploit could allow the attacker to conduct administrative functions beyond their intended access level. To exploit this vulnerability, an attacker would need Read-Only Administrator credentials."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "format": "cvssV3_1"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "Incorrect Authorization",
              "lang": "en",
              "type": "cwe"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-11-06T16:31:46.638Z",
        "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
        "shortName": "cisco"
      },
      "references": [
        {
          "name": "cisco-sa-ise-auth-bypass-BBRf7mkE",
          "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-auth-bypass-BBRf7mkE"
        }
      ],
      "source": {
        "advisory": "cisco-sa-ise-auth-bypass-BBRf7mkE",
        "defects": [
          "CSCwj28643"
        ],
        "discovery": "INTERNAL"
      },
      "title": "Cisco Identity Services Engine Authorization Bypass Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
    "assignerShortName": "cisco",
    "cveId": "CVE-2024-20537",
    "datePublished": "2024-11-06T16:31:46.638Z",
    "dateReserved": "2023-11-08T15:08:07.693Z",
    "dateUpdated": "2024-11-06T16:59:39.975Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2024-20527

Vulnerability from cvelistv5

Published

2024-11-06 16:30

Modified

2024-11-06 17:03

Severity ?

5.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N

Summary

References

▼	URL	Tags
	https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-multi-vuln-DBQdWRy

Impacted products

Vendor

Product

Version

▼

Cisco

Cisco Identity Services Engine Software

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-20527",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-06T17:03:33.846262Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-06T17:03:41.964Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Cisco Identity Services Engine Software",
          "vendor": "Cisco",
          "versions": [
            {
              "status": "affected",
              "version": "3.0.0"
            },
            {
              "status": "affected",
              "version": "3.0.0 p1"
            },
            {
              "status": "affected",
              "version": "3.0.0 p2"
            },
            {
              "status": "affected",
              "version": "3.0.0 p3"
            },
            {
              "status": "affected",
              "version": "3.1.0"
            },
            {
              "status": "affected",
              "version": "3.0.0 p4"
            },
            {
              "status": "affected",
              "version": "3.1.0 p1"
            },
            {
              "status": "affected",
              "version": "3.0.0 p5"
            },
            {
              "status": "affected",
              "version": "3.1.0 p3"
            },
            {
              "status": "affected",
              "version": "3.1.0 p2"
            },
            {
              "status": "affected",
              "version": "3.0.0 p6"
            },
            {
              "status": "affected",
              "version": "3.2.0"
            },
            {
              "status": "affected",
              "version": "3.1.0 p4"
            },
            {
              "status": "affected",
              "version": "3.1.0 p5"
            },
            {
              "status": "affected",
              "version": "3.2.0 p1"
            },
            {
              "status": "affected",
              "version": "3.0.0 p7"
            },
            {
              "status": "affected",
              "version": "3.1.0 p6"
            },
            {
              "status": "affected",
              "version": "3.2.0 p2"
            },
            {
              "status": "affected",
              "version": "3.1.0 p7"
            },
            {
              "status": "affected",
              "version": "3.3.0"
            },
            {
              "status": "affected",
              "version": "3.2.0 p3"
            },
            {
              "status": "affected",
              "version": "3.0.0 p8"
            },
            {
              "status": "affected",
              "version": "3.2.0 p4"
            },
            {
              "status": "affected",
              "version": "3.1.0 p8"
            },
            {
              "status": "affected",
              "version": "3.2.0 p5"
            },
            {
              "status": "affected",
              "version": "3.2.0 p6"
            },
            {
              "status": "affected",
              "version": "3.1.0 p9"
            },
            {
              "status": "affected",
              "version": "3.3 Patch 2"
            },
            {
              "status": "affected",
              "version": "3.3 Patch 1"
            },
            {
              "status": "affected",
              "version": "3.3 Patch 3"
            },
            {
              "status": "affected",
              "version": "3.4.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability in the API of Cisco ISE could allow an authenticated, remote attacker to read and delete arbitrary files on an affected device. To exploit this vulnerability, the attacker would need valid Super Admin credentials.\r\n\r\nThis vulnerability is due to insufficient validation of user-supplied parameters in API requests. An attacker could exploit this vulnerability by sending a crafted API request to an affected device. A successful exploit could allow the attacker to read or delete arbitrary files on the underlying operating system."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N",
            "version": "3.1"
          },
          "format": "cvssV3_1"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "cwe"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-11-06T16:30:24.026Z",
        "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
        "shortName": "cisco"
      },
      "references": [
        {
          "name": "cisco-sa-ise-multi-vuln-DBQdWRy",
          "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-multi-vuln-DBQdWRy"
        }
      ],
      "source": {
        "advisory": "cisco-sa-ise-multi-vuln-DBQdWRy",
        "defects": [
          "CSCwk47489"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Cisco Identity Services Engine Arbitrary File Read and Delete Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
    "assignerShortName": "cisco",
    "cveId": "CVE-2024-20527",
    "datePublished": "2024-11-06T16:30:24.026Z",
    "dateReserved": "2023-11-08T15:08:07.691Z",
    "dateUpdated": "2024-11-06T17:03:41.964Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2024-20530

Vulnerability from cvelistv5

Published

2024-11-06 16:30

Modified

2024-11-06 17:02

Severity ?

6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Summary

References

▼	URL	Tags
	https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-multi-vuln-DBQdWRy

Impacted products

Vendor

Product

Version

▼

Cisco

Cisco Identity Services Engine Software

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-20530",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-06T17:02:03.500683Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-06T17:02:13.227Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Cisco Identity Services Engine Software",
          "vendor": "Cisco",
          "versions": [
            {
              "status": "affected",
              "version": "3.0.0"
            },
            {
              "status": "affected",
              "version": "3.0.0 p1"
            },
            {
              "status": "affected",
              "version": "3.0.0 p2"
            },
            {
              "status": "affected",
              "version": "3.0.0 p3"
            },
            {
              "status": "affected",
              "version": "3.1.0"
            },
            {
              "status": "affected",
              "version": "3.0.0 p4"
            },
            {
              "status": "affected",
              "version": "3.1.0 p1"
            },
            {
              "status": "affected",
              "version": "3.0.0 p5"
            },
            {
              "status": "affected",
              "version": "3.1.0 p3"
            },
            {
              "status": "affected",
              "version": "3.1.0 p2"
            },
            {
              "status": "affected",
              "version": "3.0.0 p6"
            },
            {
              "status": "affected",
              "version": "3.2.0"
            },
            {
              "status": "affected",
              "version": "3.1.0 p4"
            },
            {
              "status": "affected",
              "version": "3.1.0 p5"
            },
            {
              "status": "affected",
              "version": "3.2.0 p1"
            },
            {
              "status": "affected",
              "version": "3.0.0 p7"
            },
            {
              "status": "affected",
              "version": "3.1.0 p6"
            },
            {
              "status": "affected",
              "version": "3.2.0 p2"
            },
            {
              "status": "affected",
              "version": "3.1.0 p7"
            },
            {
              "status": "affected",
              "version": "3.3.0"
            },
            {
              "status": "affected",
              "version": "3.2.0 p3"
            },
            {
              "status": "affected",
              "version": "3.0.0 p8"
            },
            {
              "status": "affected",
              "version": "3.2.0 p4"
            },
            {
              "status": "affected",
              "version": "3.1.0 p8"
            },
            {
              "status": "affected",
              "version": "3.2.0 p5"
            },
            {
              "status": "affected",
              "version": "3.2.0 p6"
            },
            {
              "status": "affected",
              "version": "3.1.0 p9"
            },
            {
              "status": "affected",
              "version": "3.3 Patch 2"
            },
            {
              "status": "affected",
              "version": "3.3 Patch 1"
            },
            {
              "status": "affected",
              "version": "3.3 Patch 3"
            },
            {
              "status": "affected",
              "version": "3.4.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability in the web-based management interface of Cisco ISE could allow an unauthenticated, remote attacker to conduct an XSS attack against a user of the interface.\r\n\r\nThis vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "cvssV3_1"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "cwe"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-11-06T16:30:54.952Z",
        "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
        "shortName": "cisco"
      },
      "references": [
        {
          "name": "cisco-sa-ise-multi-vuln-DBQdWRy",
          "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-multi-vuln-DBQdWRy"
        }
      ],
      "source": {
        "advisory": "cisco-sa-ise-multi-vuln-DBQdWRy",
        "defects": [
          "CSCwk47454"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Cisco Identity Services Engine Reflected Cross-Site Scripting Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
    "assignerShortName": "cisco",
    "cveId": "CVE-2024-20530",
    "datePublished": "2024-11-06T16:30:54.952Z",
    "dateReserved": "2023-11-08T15:08:07.692Z",
    "dateUpdated": "2024-11-06T17:02:13.227Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2024-20529

Vulnerability from cvelistv5

Published

2024-11-06 16:30

Modified

2024-11-06 17:02

Severity ?

5.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N

Summary

References

▼	URL	Tags
	https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-multi-vuln-DBQdWRy

Impacted products

Vendor

Product

Version

▼

Cisco

Cisco Identity Services Engine Software

Version: 3.1.0
Version: 3.1.0 p1
Version: 3.1.0 p3
Version: 3.1.0 p2
Version: 3.2.0
Version: 3.1.0 p4
Version: 3.1.0 p5
Version: 3.2.0 p1
Version: 3.1.0 p6
Version: 3.2.0 p2
Version: 3.1.0 p7
Version: 3.3.0
Version: 3.2.0 p3
Version: 3.2.0 p4
Version: 3.1.0 p8
Version: 3.2.0 p5
Version: 3.2.0 p6
Version: 3.1.0 p9
Version: 3.3 Patch 2
Version: 3.3 Patch 1
Version: 3.3 Patch 3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-20529",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-06T17:02:36.678122Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-06T17:02:51.141Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Cisco Identity Services Engine Software",
          "vendor": "Cisco",
          "versions": [
            {
              "status": "affected",
              "version": "3.1.0"
            },
            {
              "status": "affected",
              "version": "3.1.0 p1"
            },
            {
              "status": "affected",
              "version": "3.1.0 p3"
            },
            {
              "status": "affected",
              "version": "3.1.0 p2"
            },
            {
              "status": "affected",
              "version": "3.2.0"
            },
            {
              "status": "affected",
              "version": "3.1.0 p4"
            },
            {
              "status": "affected",
              "version": "3.1.0 p5"
            },
            {
              "status": "affected",
              "version": "3.2.0 p1"
            },
            {
              "status": "affected",
              "version": "3.1.0 p6"
            },
            {
              "status": "affected",
              "version": "3.2.0 p2"
            },
            {
              "status": "affected",
              "version": "3.1.0 p7"
            },
            {
              "status": "affected",
              "version": "3.3.0"
            },
            {
              "status": "affected",
              "version": "3.2.0 p3"
            },
            {
              "status": "affected",
              "version": "3.2.0 p4"
            },
            {
              "status": "affected",
              "version": "3.1.0 p8"
            },
            {
              "status": "affected",
              "version": "3.2.0 p5"
            },
            {
              "status": "affected",
              "version": "3.2.0 p6"
            },
            {
              "status": "affected",
              "version": "3.1.0 p9"
            },
            {
              "status": "affected",
              "version": "3.3 Patch 2"
            },
            {
              "status": "affected",
              "version": "3.3 Patch 1"
            },
            {
              "status": "affected",
              "version": "3.3 Patch 3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability in the API of Cisco ISE could allow an authenticated, remote attacker to read and delete arbitrary files on an affected device. To exploit this vulnerability, the attacker would need valid Super Admin credentials.\r\n\r\nThis vulnerability is due to insufficient validation of user-supplied parameters in API requests. An attacker could exploit this vulnerability by sending a crafted API request to an affected device. A successful exploit could allow the attacker to read or delete arbitrary files on the underlying operating system."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N",
            "version": "3.1"
          },
          "format": "cvssV3_1"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "cwe"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-11-06T16:30:43.785Z",
        "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
        "shortName": "cisco"
      },
      "references": [
        {
          "name": "cisco-sa-ise-multi-vuln-DBQdWRy",
          "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-multi-vuln-DBQdWRy"
        }
      ],
      "source": {
        "advisory": "cisco-sa-ise-multi-vuln-DBQdWRy",
        "defects": [
          "CSCwk47445"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Cisco Identity Services Engine Arbitrary File Read and Delete Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
    "assignerShortName": "cisco",
    "cveId": "CVE-2024-20529",
    "datePublished": "2024-11-06T16:30:43.785Z",
    "dateReserved": "2023-11-08T15:08:07.691Z",
    "dateUpdated": "2024-11-06T17:02:51.141Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

Vulnerability from csaf_ncscnl

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature