CVE-2023-20172
Assigner: cisco
Published: 2023-05-18T00:00:00
State: PUBLISHED
title: Cisco Identity Services Engine Arbitrary File Delete and File Read Vulnerabilities
datePublic: 2023-05-17T00:00:00
descriptions: value: Multiple vulnerabilities in Cisco Identity Services Engine (ISE) could allow an authenticated attacker to delete or read arbitrary files on the underlying operating system. To exploit these vulnerabilities, an attacker must have valid credentials on an affected device. For more information about these vulnerabilities, see the Details section of this advisory.
affected: vendor: Cisco
product: Cisco Identity Services Engine Software 
versions: version: n/a
status: affected
metrics: cvssV3_1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
problemTypes: descriptions: type: CWE
description: CWE-602
cweId: CWE-602
source: advisory: cisco-sa-ise-file-delete-read-PK5ghDDd
defect: CSCwc86067
CSCwd38138
CSCwd63674
CSCwd93718
discovery: INTERNAL
exploits: value: The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory.