Cisco ISE Web UI Data Disclosure via Read-Only Admin
CVE-2024-20515 Published on October 2, 2024
Cisco Identity Services Engine Information Disclosure Vulnerability
A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to obtain sensitive information from an affected device.
This vulnerability is due to a lack of proper data protection mechanisms for certain configuration settings. An attacker with Read-Only Administrator privileges could exploit this vulnerability by browsing to a page that contains sensitive data. A successful exploit could allow the attacker to view device credentials that are normally not visible to Read-Only Administrators.
Vulnerability Analysis
CVE-2024-20515 can be exploited with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality, with no impact on integrity and availability.
Weakness Type
Missing Encryption of Sensitive Data
The software does not encrypt sensitive or critical information before storage or transmission. The lack of proper data encryption passes up the guarantees of confidentiality, integrity, and accountability that properly implemented encryption conveys.
Products Associated with CVE-2024-20515
Want to know whenever a new CVE is published for Cisco Identity Services Engine? stack.watch will email you.
Affected Versions
Cisco Identity Services Engine Software:- Version 3.0.0 is affected.
- Version 3.0.0 p1 is affected.
- Version 3.0.0 p2 is affected.
- Version 3.0.0 p3 is affected.
- Version 3.1.0 is affected.
- Version 3.0.0 p4 is affected.
- Version 3.1.0 p1 is affected.
- Version 3.0.0 p5 is affected.
- Version 3.1.0 p3 is affected.
- Version 3.1.0 p2 is affected.
- Version 3.0.0 p6 is affected.
- Version 3.2.0 is affected.
- Version 3.1.0 p4 is affected.
- Version 2.7.0 p8 is affected.
- Version 3.1.0 p5 is affected.
- Version 3.2.0 p1 is affected.
- Version 3.0.0 p7 is affected.
- Version 3.1.0 p6 is affected.
- Version 3.2.0 p2 is affected.
- Version 3.1.0 p7 is affected.
- Version 3.3.0 is affected.
- Version 3.2.0 p3 is affected.
- Version 3.0.0 p8 is affected.
- Version 3.2.0 p4 is affected.
- Version 3.1.0 p8 is affected.
- Version 3.2.0 p5 is affected.
- Version 3.2.0 p6 is affected.
- Version 3.3 Patch 2 is affected.
- Version 3.3 Patch 1 is affected.
- Version 3.3 Patch 3 is affected.
- Version 3.4.0 is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.