Networking-Forums.com

Cisco Identity Services Engine Sensitive Information Disclosure Vulnerability

<p>A vulnerability in the web-based management interface of Cisco&nbsp;Identity Services Engine (ISE) could allow an authenticated, remote attacker to obtain sensitive information from an affected device. &nbsp;</p>
<p>This vulnerability exists because administrative privilege levels for sensitive data are not properly enforced. An attacker with <em>read-only</em> privileges for the web-based management interface on an affected device could exploit this vulnerability by browsing to a page that contains sensitive data. A successful exploit could allow the attacker to collect sensitive information about the system configuration.&nbsp;</p>
<p>Cisco&nbsp;has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.</p>
<p>This advisory is available at the following link:<br><a href="https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-info-disclosure-Os6fSd6N">https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-info-disclosure-Os6fSd6N</a></p>

     
         
Security Impact Rating:  Medium
   
   
       
CVE: CVE-2022-20819
Source: Cisco Identity Services Engine Sensitive Information Disclosure Vulnerability (https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-info-disclosure-Os6fSd6N?vs_f=Cisco%20Security%20Advisory&vs_cat=Security%20Intelligence&vs_type=RSS&vs_p=Cisco%20Identity%20Services%20Engine%20Sensitive%20Information%20Disclosure%20Vulnerability&vs_k=1)