CVE-2020-3467— Cisco Identity Services Engine Authorization Bypass Vulnerability

Cisco Identity Services Engine Authorization Bypass Vulnerability

A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to modify parts of the configuration on an affected device. The vulnerability is due to improper enforcement of role-based access control (RBAC) within the web-based management interface. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to modify parts of the configuration. The modified configuration could either allow unauthorized devices onto the network or prevent authorized devices from accessing the network. To exploit this vulnerability, an attacker would need valid Read-Only Administrator credentials.

N/A

授权机制不正确

Cisco Identity Services Engine 安全漏洞

Cisco Identity Services Engine（ISE）是美国思科（Cisco）公司的一款基于身份的环境感知平台（ISE身份服务引擎）。该平台通过收集网络、用户和设备中的实时信息，制定并实施相应策略来监管网络。 Cisco Identity Services Engine (ISE) 存在安全漏洞，攻击者可利用该漏洞修改部分的配置。修改后的配置可以允许未经授权的设备到网络或防止授权的设备访问网络。

N/A

N/A