CVE-2023-20164 - Vulnerability Details

Vendors	Products
Cisco	Identity Services Engine

Link	Providers
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-injection-sRQnsEU9

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Show plain JSON

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2023-20164", "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "assignerShortName": "cisco", "dateUpdated": "2024-10-28T16:29:41.515Z", "dateReserved": "2022-10-27T00:00:00", "datePublished": "2023-05-18T00:00:00"}, "containers": {"cna": {"title": "Cisco Identity Services Engine Command Injection Vulnerabilities", "datePublic": "2023-05-17T00:00:00", "providerMetadata": {"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "shortName": "cisco", "dateUpdated": "2023-05-18T00:00:00"}, "descriptions": [{"lang": "en", "value": "Multiple vulnerabilities in Cisco Identity Services Engine (ISE) could allow an authenticated attacker to perform command injection attacks on the underlying operating system and elevate privileges to root. To exploit these vulnerabilities, an attacker must have valid credentials on an affected device. For more information about these vulnerabilities, see the Details section of this advisory."}], "affected": [{"vendor": "Cisco", "product": "Cisco Identity Services Engine Software ", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"name": "20230517 Cisco Identity Services Engine Command Injection Vulnerabilities", "tags": ["vendor-advisory"], "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-injection-sRQnsEU9"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM"}}], "problemTypes": [{"descriptions": [{"type": "CWE", "lang": "en", "description": "CWE-78", "cweId": "CWE-78"}]}], "source": {"advisory": "cisco-sa-ise-injection-sRQnsEU9", "defect": [["CSCwd30039", "CSCwd41219"]], "discovery": "INTERNAL"}, "exploits": [{"lang": "en", "value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory. "}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T09:05:35.604Z"}, "title": "CVE Program Container", "references": [{"name": "20230517 Cisco Identity Services Engine Command Injection Vulnerabilities", "tags": ["vendor-advisory", "x_transferred"], "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-injection-sRQnsEU9"}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-10-28T16:18:57.871004Z", "id": "CVE-2023-20164", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-28T16:29:41.515Z"}}]}}

{

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

cveMetadata : { »

state : PUBLISHED (string)

cveId : CVE-2023-20164 (string)

assignerOrgId : d1c1063e-7a18-46af-9102-31f8928bc633 (string)

assignerShortName : cisco (string)

dateUpdated : 2024-10-28T16:29:41.515Z (string)

dateReserved : 2022-10-27T00:00:00 (string)

datePublished : 2023-05-18T00:00:00 (string)

}

containers : { »

cna : { »

title : Cisco Identity Services Engine Command Injection Vulnerabilities (string)

datePublic : 2023-05-17T00:00:00 (string)

providerMetadata : { »

orgId : d1c1063e-7a18-46af-9102-31f8928bc633 (string)

shortName : cisco (string)

dateUpdated : 2023-05-18T00:00:00 (string)

}

descriptions : [ »

0 : { »

lang : en (string)

value : Multiple vulnerabilities in Cisco Identity Services Engine (ISE) could allow an authenticated attacker to perform command injection attacks on the underlying operating system and elevate privileges to root. To exploit these vulnerabilities, an attacker must have valid credentials on an affected device. For more information about these vulnerabilities, see the Details section of this advisory. (string)

}

]

affected : [ »

0 : { »

vendor : Cisco (string)

product : Cisco Identity Services Engine Software (string)

versions : [ »

0 : { »

version : n/a (string)

status : affected (string)

}

]

}

]

references : [ »

0 : { »

name : 20230517 Cisco Identity Services Engine Command Injection Vulnerabilities (string)

tags : [ »

0 : vendor-advisory (string)

]

url : https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-injection-sRQnsEU9 (string)

}

]

metrics : [ »

0 : { »

cvssV3_1 : { »

version : 3.1 (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N (string)

attackVector : NETWORK (string)

attackComplexity : LOW (string)

privilegesRequired : HIGH (string)

userInteraction : NONE (string)

scope : UNCHANGED (string)

confidentialityImpact : HIGH (string)

integrityImpact : HIGH (string)

availabilityImpact : NONE (string)

baseScore : 6.5 (number)

baseSeverity : MEDIUM (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

type : CWE (string)

lang : en (string)

description : CWE-78 (string)

cweId : CWE-78 (string)

}

]

}

]

source : { »

advisory : cisco-sa-ise-injection-sRQnsEU9 (string)

defect : [ »

0 : [ »

0 : CSCwd30039 (string)

1 : CSCwd41219 (string)

]

discovery : INTERNAL (string)

}

exploits : [ »

0 : { »

lang : en (string)

value : The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory. (string)

}

]

}

adp : [ »

0 : { »

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-02T09:05:35.604Z (string)

}

title : CVE Program Container (string)

references : [ »

0 : { »

name : 20230517 Cisco Identity Services Engine Command Injection Vulnerabilities (string)

tags : [ »

0 : vendor-advisory (string)

1 : x_transferred (string)

]

url : https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-injection-sRQnsEU9 (string)

}

]

}

1 : { »

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

timestamp : 2024-10-28T16:18:57.871004Z (string)

id : CVE-2023-20164 (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : total (string)

}

]

role : CISA Coordinator (string)

version : 2.0.3 (string)

}

]

title : CISA ADP Vulnrichment (string)

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2024-10-28T16:29:41.515Z (string)

}

]

}

Show plain JSON

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-injection-sRQnsEU9", "name": "20230517 Cisco Identity Services Engine Command Injection Vulnerabilities", "tags": ["vendor-advisory", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T09:05:35.604Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-20164", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-10-28T16:18:57.871004Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-28T16:22:41.769Z"}}], "cna": {"title": "Cisco Identity Services Engine Command Injection Vulnerabilities", "source": {"defect": [["CSCwd30039", "CSCwd41219"]], "advisory": "cisco-sa-ise-injection-sRQnsEU9", "discovery": "INTERNAL"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "Cisco", "product": "Cisco Identity Services Engine Software ", "versions": [{"status": "affected", "version": "n/a"}]}], "exploits": [{"lang": "en", "value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory. "}], "datePublic": "2023-05-17T00:00:00", "references": [{"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-injection-sRQnsEU9", "name": "20230517 Cisco Identity Services Engine Command Injection Vulnerabilities", "tags": ["vendor-advisory"]}], "descriptions": [{"lang": "en", "value": "Multiple vulnerabilities in Cisco Identity Services Engine (ISE) could allow an authenticated attacker to perform command injection attacks on the underlying operating system and elevate privileges to root. To exploit these vulnerabilities, an attacker must have valid credentials on an affected device. For more information about these vulnerabilities, see the Details section of this advisory."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-78", "description": "CWE-78"}]}], "providerMetadata": {"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "shortName": "cisco", "dateUpdated": "2023-05-18T00:00:00"}}}, "cveMetadata": {"cveId": "CVE-2023-20164", "state": "PUBLISHED", "dateUpdated": "2024-10-28T16:29:41.515Z", "dateReserved": "2022-10-27T00:00:00", "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "datePublished": "2023-05-18T00:00:00", "assignerShortName": "cisco"}, "dataVersion": "5.1"}

{

dataType : CVE_RECORD (string)

containers : { »

adp : [ »

0 : { »

title : CVE Program Container (string)

references : [ »

0 : { »

url : https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-injection-sRQnsEU9 (string)

name : 20230517 Cisco Identity Services Engine Command Injection Vulnerabilities (string)

tags : [ »

0 : vendor-advisory (string)

1 : x_transferred (string)

]

}

]

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-02T09:05:35.604Z (string)

}

1 : { »

title : CISA ADP Vulnrichment (string)

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

id : CVE-2023-20164 (string)

role : CISA Coordinator (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : total (string)

}

]

version : 2.0.3 (string)

timestamp : 2024-10-28T16:18:57.871004Z (string)

}

]

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2024-10-28T16:22:41.769Z (string)

}

]

cna : { »

title : Cisco Identity Services Engine Command Injection Vulnerabilities (string)

source : { »

defect : [ »

0 : [ »

0 : CSCwd30039 (string)

1 : CSCwd41219 (string)

]

advisory : cisco-sa-ise-injection-sRQnsEU9 (string)

discovery : INTERNAL (string)

}

metrics : [ »

0 : { »

cvssV3_1 : { »

scope : UNCHANGED (string)

version : 3.1 (string)

baseScore : 6.5 (number)

attackVector : NETWORK (string)

baseSeverity : MEDIUM (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N (string)

integrityImpact : HIGH (string)

userInteraction : NONE (string)

attackComplexity : LOW (string)

availabilityImpact : NONE (string)

privilegesRequired : HIGH (string)

confidentialityImpact : HIGH (string)

}

]

affected : [ »

0 : { »

vendor : Cisco (string)

product : Cisco Identity Services Engine Software (string)

versions : [ »

0 : { »

status : affected (string)

version : n/a (string)

}

]

}

]

exploits : [ »

0 : { »

lang : en (string)

value : The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory. (string)

}

]

datePublic : 2023-05-17T00:00:00 (string)

references : [ »

0 : { »

url : https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-injection-sRQnsEU9 (string)

name : 20230517 Cisco Identity Services Engine Command Injection Vulnerabilities (string)

tags : [ »

0 : vendor-advisory (string)

]

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : Multiple vulnerabilities in Cisco Identity Services Engine (ISE) could allow an authenticated attacker to perform command injection attacks on the underlying operating system and elevate privileges to root. To exploit these vulnerabilities, an attacker must have valid credentials on an affected device. For more information about these vulnerabilities, see the Details section of this advisory. (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

lang : en (string)

type : CWE (string)

cweId : CWE-78 (string)

description : CWE-78 (string)

}

]

}

]

providerMetadata : { »

orgId : d1c1063e-7a18-46af-9102-31f8928bc633 (string)

shortName : cisco (string)

dateUpdated : 2023-05-18T00:00:00 (string)

}

cveMetadata : { »

cveId : CVE-2023-20164 (string)

state : PUBLISHED (string)

dateUpdated : 2024-10-28T16:29:41.515Z (string)

dateReserved : 2022-10-27T00:00:00 (string)

assignerOrgId : d1c1063e-7a18-46af-9102-31f8928bc633 (string)

datePublished : 2023-05-18T00:00:00 (string)

assignerShortName : cisco (string)

}

dataVersion : 5.1 (string)

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:cisco:identity_services_engine:*:*:*:*:*:*:*:*", "matchCriteriaId": "DDE2869D-6E9E-4717-A8D4-9E3204889F14", "versionEndIncluding": "2.7", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:identity_services_engine:3.0.0:-:*:*:*:*:*:*", "matchCriteriaId": "A1063044-BCD7-487F-9880-141C30547E36", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:identity_services_engine:3.0.0:patch1:*:*:*:*:*:*", "matchCriteriaId": "DA42E65A-7207-48B8-BE1B-0B352201BC09", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:identity_services_engine:3.0.0:patch2:*:*:*:*:*:*", "matchCriteriaId": "75DDAF38-4D5F-4EE4-A428-68D28FC0DA96", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:identity_services_engine:3.0.0:patch3:*:*:*:*:*:*", "matchCriteriaId": "C5FB6AA6-F8C9-48A6-BDDA-1D25C43564EB", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:identity_services_engine:3.0.0:patch4:*:*:*:*:*:*", "matchCriteriaId": "2B3A267A-5FEA-426D-903E-BD3F4F94A1A4", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:identity_services_engine:3.0.0:patch5:*:*:*:*:*:*", "matchCriteriaId": "B1B3207B-1B9C-41AA-8EF6-8478458462E7", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:identity_services_engine:3.0.0:patch6:*:*:*:*:*:*", "matchCriteriaId": "C5B9E7F3-B0F2-4A6A-B939-A62E9B12CCEB", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:identity_services_engine:3.0.0:patch7:*:*:*:*:*:*", "matchCriteriaId": "EF4C5A58-D0AE-48D6-9757-18C1D5BE5070", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:identity_services_engine:3.1:-:*:*:*:*:*:*", "matchCriteriaId": "C4DB9726-532F-45CE-81FD-45F2F6C7CE51", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:identity_services_engine:3.1:patch1:*:*:*:*:*:*", "matchCriteriaId": "2E8F0066-0EC0-41FD-80BE-55C4ED5F6B0E", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:identity_services_engine:3.1:patch3:*:*:*:*:*:*", "matchCriteriaId": "5D1765DB-1BEF-4CE9-8B86-B91F709600EB", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:identity_services_engine:3.1:patch4:*:*:*:*:*:*", "matchCriteriaId": "3D1E80EF-C3FD-4F7A-B63D-0EAA5C878B11", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:identity_services_engine:3.1:patch5:*:*:*:*:*:*", "matchCriteriaId": "095F27EC-5713-4D4F-AD06-57D3DF068B90", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:identity_services_engine:3.1:patch6:*:*:*:*:*:*", "matchCriteriaId": "FEA5210C-E674-4C4B-9EB3-C681C70005B6", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:identity_services_engine:3.2:-:*:*:*:*:*:*", "matchCriteriaId": "36722B6C-64A5-4D00-94E1-442878C37A35", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:identity_services_engine:3.2:patch1:*:*:*:*:*:*", "matchCriteriaId": "7EEEA06A-AD58-48D3-8975-B21A961985B3", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Multiple vulnerabilities in Cisco Identity Services Engine (ISE) could allow an authenticated attacker to perform command injection attacks on the underlying operating system and elevate privileges to root. To exploit these vulnerabilities, an attacker must have valid credentials on an affected device. For more information about these vulnerabilities, see the Details section of this advisory."}], "id": "CVE-2023-20164", "lastModified": "2024-11-21T07:40:43.500", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 5.2, "source": "ykramarz@cisco.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-05-18T03:15:10.547", "references": [{"source": "ykramarz@cisco.com", "tags": ["Vendor Advisory"], "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-injection-sRQnsEU9"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-injection-sRQnsEU9"}], "sourceIdentifier": "ykramarz@cisco.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-78"}], "source": "ykramarz@cisco.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-78"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:cisco:identity_services_engine:*:*:*:*:*:*:*:* (string)

matchCriteriaId : DDE2869D-6E9E-4717-A8D4-9E3204889F14 (string)

versionEndIncluding : 2.7 (string)

vulnerable : true (boolean)

}

1 : { »

criteria : cpe:2.3:a:cisco:identity_services_engine:3.0.0:-:*:*:*:*:*:* (string)

matchCriteriaId : A1063044-BCD7-487F-9880-141C30547E36 (string)

vulnerable : true (boolean)

}

2 : { »

criteria : cpe:2.3:a:cisco:identity_services_engine:3.0.0:patch1:*:*:*:*:*:* (string)

matchCriteriaId : DA42E65A-7207-48B8-BE1B-0B352201BC09 (string)

vulnerable : true (boolean)

}

3 : { »

criteria : cpe:2.3:a:cisco:identity_services_engine:3.0.0:patch2:*:*:*:*:*:* (string)

matchCriteriaId : 75DDAF38-4D5F-4EE4-A428-68D28FC0DA96 (string)

vulnerable : true (boolean)

}

4 : { »

criteria : cpe:2.3:a:cisco:identity_services_engine:3.0.0:patch3:*:*:*:*:*:* (string)

matchCriteriaId : C5FB6AA6-F8C9-48A6-BDDA-1D25C43564EB (string)

vulnerable : true (boolean)

}

5 : { »

criteria : cpe:2.3:a:cisco:identity_services_engine:3.0.0:patch4:*:*:*:*:*:* (string)

matchCriteriaId : 2B3A267A-5FEA-426D-903E-BD3F4F94A1A4 (string)

vulnerable : true (boolean)

}

6 : { »

criteria : cpe:2.3:a:cisco:identity_services_engine:3.0.0:patch5:*:*:*:*:*:* (string)

matchCriteriaId : B1B3207B-1B9C-41AA-8EF6-8478458462E7 (string)

vulnerable : true (boolean)

}

7 : { »

criteria : cpe:2.3:a:cisco:identity_services_engine:3.0.0:patch6:*:*:*:*:*:* (string)

matchCriteriaId : C5B9E7F3-B0F2-4A6A-B939-A62E9B12CCEB (string)

vulnerable : true (boolean)

}

8 : { »

criteria : cpe:2.3:a:cisco:identity_services_engine:3.0.0:patch7:*:*:*:*:*:* (string)

matchCriteriaId : EF4C5A58-D0AE-48D6-9757-18C1D5BE5070 (string)

vulnerable : true (boolean)

}

9 : { »

criteria : cpe:2.3:a:cisco:identity_services_engine:3.1:-:*:*:*:*:*:* (string)

matchCriteriaId : C4DB9726-532F-45CE-81FD-45F2F6C7CE51 (string)

vulnerable : true (boolean)

}

10 : { »

criteria : cpe:2.3:a:cisco:identity_services_engine:3.1:patch1:*:*:*:*:*:* (string)

matchCriteriaId : 2E8F0066-0EC0-41FD-80BE-55C4ED5F6B0E (string)

vulnerable : true (boolean)

}

11 : { »

criteria : cpe:2.3:a:cisco:identity_services_engine:3.1:patch3:*:*:*:*:*:* (string)

matchCriteriaId : 5D1765DB-1BEF-4CE9-8B86-B91F709600EB (string)

vulnerable : true (boolean)

}

12 : { »

criteria : cpe:2.3:a:cisco:identity_services_engine:3.1:patch4:*:*:*:*:*:* (string)

matchCriteriaId : 3D1E80EF-C3FD-4F7A-B63D-0EAA5C878B11 (string)

vulnerable : true (boolean)

}

13 : { »

criteria : cpe:2.3:a:cisco:identity_services_engine:3.1:patch5:*:*:*:*:*:* (string)

matchCriteriaId : 095F27EC-5713-4D4F-AD06-57D3DF068B90 (string)

vulnerable : true (boolean)

}

14 : { »

criteria : cpe:2.3:a:cisco:identity_services_engine:3.1:patch6:*:*:*:*:*:* (string)

matchCriteriaId : FEA5210C-E674-4C4B-9EB3-C681C70005B6 (string)

vulnerable : true (boolean)

}

15 : { »

criteria : cpe:2.3:a:cisco:identity_services_engine:3.2:-:*:*:*:*:*:* (string)

matchCriteriaId : 36722B6C-64A5-4D00-94E1-442878C37A35 (string)

vulnerable : true (boolean)

}

16 : { »

criteria : cpe:2.3:a:cisco:identity_services_engine:3.2:patch1:*:*:*:*:*:* (string)

matchCriteriaId : 7EEEA06A-AD58-48D3-8975-B21A961985B3 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : Multiple vulnerabilities in Cisco Identity Services Engine (ISE) could allow an authenticated attacker to perform command injection attacks on the underlying operating system and elevate privileges to root. To exploit these vulnerabilities, an attacker must have valid credentials on an affected device. For more information about these vulnerabilities, see the Details section of this advisory. (string)

}

]

id : CVE-2023-20164 (string)

lastModified : 2024-11-21T07:40:43.500 (string)

metrics : { »

cvssMetricV31 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 6.5 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : HIGH (string)

integrityImpact : HIGH (string)

privilegesRequired : HIGH (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N (string)

version : 3.1 (string)

}

exploitabilityScore : 1.2 (number)

impactScore : 5.2 (number)

source : ykramarz@cisco.com (string)

type : Secondary (string)

}

1 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : HIGH (string)

baseScore : 7.2 (number)

baseSeverity : HIGH (string)

confidentialityImpact : HIGH (string)

integrityImpact : HIGH (string)

privilegesRequired : HIGH (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H (string)

version : 3.1 (string)

}

exploitabilityScore : 1.2 (number)

impactScore : 5.9 (number)

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

published : 2023-05-18T03:15:10.547 (string)

references : [ »

0 : { »

source : ykramarz@cisco.com (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-injection-sRQnsEU9 (string)

}

1 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-injection-sRQnsEU9 (string)

}

]

sourceIdentifier : ykramarz@cisco.com (string)

vulnStatus : Modified (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-78 (string)

}

]

source : ykramarz@cisco.com (string)

type : Secondary (string)

}

1 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-78 (string)

}

]

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction None

Exploitation none

Automatable no

Technical Impact total

Affected Vendors & Products

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction None

Exploitation none

Automatable no

Technical Impact total

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object