VAR-201401-0329

Vulnerability from variot - Updated: 2025-04-11 23:17

The RBAC implementation in Cisco Identity Services Engine (ISE) Software does not properly verify privileges for support-bundle downloads, which allows remote authenticated users to obtain sensitive information via a download action, as demonstrated by obtaining read access to the user database, aka Bug ID CSCul83904. An attacker can exploit this issue to gain unauthorized access and obtain sensitive information. This may aid in further attacks. This issue is being tracked by Cisco Bug ID CSCul83904. Cisco Identity Services Engine (ISE) is an identity-based context-aware platform (ISE Identity Services Engine) from Cisco. The platform monitors the network by collecting real-time information on the network, users and devices, and formulating and implementing corresponding policies. A permissions and access control vulnerability exists in Cisco ISE Software's role-based access control code

Show details on source website
To clipboard 

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-201401-0329",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "identity services engine software",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "cisco",
        "version": null
      },
      {
        "model": "identity services engine",
        "scope": null,
        "trust": 0.8,
        "vendor": "cisco",
        "version": null
      },
      {
        "model": "identity services engine software",
        "scope": "lte",
        "trust": 0.8,
        "vendor": "cisco",
        "version": "1.2 patch 2"
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-001069"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201401-326"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-0665"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "cpe_match": [
              {
                "cpe22Uri": "cpe:/h:cisco:identity_services_engine",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/a:cisco:identity_services_engine_software",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-001069"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Cisco",
    "sources": [
      {
        "db": "BID",
        "id": "64939"
      }
    ],
    "trust": 0.3
  },
  "cve": "CVE-2014-0665",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "author": "nvd@nist.gov",
            "availabilityImpact": "NONE",
            "baseScore": 4.0,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 8.0,
            "id": "CVE-2014-0665",
            "impactScore": 2.9,
            "integrityImpact": "NONE",
            "severity": "MEDIUM",
            "trust": 1.9,
            "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
            "version": "2.0"
          },
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "author": "VULHUB",
            "availabilityImpact": "NONE",
            "baseScore": 4.0,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 8.0,
            "id": "VHN-68158",
            "impactScore": 2.9,
            "integrityImpact": "NONE",
            "severity": "MEDIUM",
            "trust": 0.1,
            "vectorString": "AV:N/AC:L/AU:S/C:P/I:N/A:N",
            "version": "2.0"
          }
        ],
        "cvssV3": [],
        "severity": [
          {
            "author": "nvd@nist.gov",
            "id": "CVE-2014-0665",
            "trust": 1.0,
            "value": "MEDIUM"
          },
          {
            "author": "NVD",
            "id": "CVE-2014-0665",
            "trust": 0.8,
            "value": "Medium"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-201401-326",
            "trust": 0.6,
            "value": "MEDIUM"
          },
          {
            "author": "VULHUB",
            "id": "VHN-68158",
            "trust": 0.1,
            "value": "MEDIUM"
          },
          {
            "author": "VULMON",
            "id": "CVE-2014-0665",
            "trust": 0.1,
            "value": "MEDIUM"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-68158"
      },
      {
        "db": "VULMON",
        "id": "CVE-2014-0665"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-001069"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201401-326"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-0665"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "The RBAC implementation in Cisco Identity Services Engine (ISE) Software does not properly verify privileges for support-bundle downloads, which allows remote authenticated users to obtain sensitive information via a download action, as demonstrated by obtaining read access to the user database, aka Bug ID CSCul83904. \nAn attacker can exploit this issue to gain unauthorized access and obtain sensitive information. This may aid in further attacks. \nThis issue is being tracked by Cisco Bug ID CSCul83904. Cisco Identity Services Engine (ISE) is an identity-based context-aware platform (ISE Identity Services Engine) from Cisco. The platform monitors the network by collecting real-time information on the network, users and devices, and formulating and implementing corresponding policies. A permissions and access control vulnerability exists in Cisco ISE Software\u0027s role-based access control code",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2014-0665"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-001069"
      },
      {
        "db": "BID",
        "id": "64939"
      },
      {
        "db": "VULHUB",
        "id": "VHN-68158"
      },
      {
        "db": "VULMON",
        "id": "CVE-2014-0665"
      }
    ],
    "trust": 2.07
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2014-0665",
        "trust": 2.9
      },
      {
        "db": "BID",
        "id": "64939",
        "trust": 1.5
      },
      {
        "db": "SECUNIA",
        "id": "56439",
        "trust": 1.2
      },
      {
        "db": "OSVDB",
        "id": "102118",
        "trust": 1.2
      },
      {
        "db": "SECTRACK",
        "id": "1029624",
        "trust": 1.2
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-001069",
        "trust": 0.8
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201401-326",
        "trust": 0.7
      },
      {
        "db": "CISCO",
        "id": "20140115 CISCO ISE UNPRIVILEGED SUPPORT BUNDLE DOWNLOAD VULNERABILITY",
        "trust": 0.6
      },
      {
        "db": "VULHUB",
        "id": "VHN-68158",
        "trust": 0.1
      },
      {
        "db": "VULMON",
        "id": "CVE-2014-0665",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-68158"
      },
      {
        "db": "VULMON",
        "id": "CVE-2014-0665"
      },
      {
        "db": "BID",
        "id": "64939"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-001069"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201401-326"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-0665"
      }
    ]
  },
  "id": "VAR-201401-0329",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-68158"
      }
    ],
    "trust": 0.01
  },
  "last_update_date": "2025-04-11T23:17:14.548000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "Cisco ISE Unprivileged Support Bundle Download Vulnerability",
        "trust": 0.8,
        "url": "http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0665"
      },
      {
        "title": "32448",
        "trust": 0.8,
        "url": "http://tools.cisco.com/security/center/viewAlert.x?alertId=32448"
      },
      {
        "title": "Cisco: Cisco ISE Unprivileged Support Bundle Download Vulnerability",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=cisco_security_advisories_and_alerts_ciscoproducts\u0026qid=Cisco-SA-20140115-CVE-2014-0665"
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2014-0665"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-001069"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-264",
        "trust": 1.9
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-68158"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-001069"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-0665"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 1.8,
        "url": "http://tools.cisco.com/security/center/content/ciscosecuritynotice/cve-2014-0665"
      },
      {
        "trust": 1.3,
        "url": "http://www.securityfocus.com/bid/64939"
      },
      {
        "trust": 1.2,
        "url": "http://tools.cisco.com/security/center/viewalert.x?alertid=32448"
      },
      {
        "trust": 1.2,
        "url": "http://osvdb.org/102118"
      },
      {
        "trust": 1.2,
        "url": "http://www.securitytracker.com/id/1029624"
      },
      {
        "trust": 1.2,
        "url": "http://secunia.com/advisories/56439"
      },
      {
        "trust": 1.2,
        "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/90463"
      },
      {
        "trust": 0.8,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-0665"
      },
      {
        "trust": 0.8,
        "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2014-0665"
      },
      {
        "trust": 0.3,
        "url": "http://www.cisco.com"
      },
      {
        "trust": 0.1,
        "url": "https://cwe.mitre.org/data/definitions/264.html"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov"
      },
      {
        "trust": 0.1,
        "url": "http://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20140115-cve-2014-0665"
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-68158"
      },
      {
        "db": "VULMON",
        "id": "CVE-2014-0665"
      },
      {
        "db": "BID",
        "id": "64939"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-001069"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201401-326"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-0665"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "VULHUB",
        "id": "VHN-68158"
      },
      {
        "db": "VULMON",
        "id": "CVE-2014-0665"
      },
      {
        "db": "BID",
        "id": "64939"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-001069"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201401-326"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-0665"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2014-01-15T00:00:00",
        "db": "VULHUB",
        "id": "VHN-68158"
      },
      {
        "date": "2014-01-15T00:00:00",
        "db": "VULMON",
        "id": "CVE-2014-0665"
      },
      {
        "date": "2014-01-15T00:00:00",
        "db": "BID",
        "id": "64939"
      },
      {
        "date": "2014-01-16T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2014-001069"
      },
      {
        "date": "2014-01-18T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201401-326"
      },
      {
        "date": "2014-01-15T16:11:08.457000",
        "db": "NVD",
        "id": "CVE-2014-0665"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2017-08-29T00:00:00",
        "db": "VULHUB",
        "id": "VHN-68158"
      },
      {
        "date": "2017-08-29T00:00:00",
        "db": "VULMON",
        "id": "CVE-2014-0665"
      },
      {
        "date": "2014-01-15T00:00:00",
        "db": "BID",
        "id": "64939"
      },
      {
        "date": "2014-01-16T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2014-001069"
      },
      {
        "date": "2014-01-18T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201401-326"
      },
      {
        "date": "2025-04-11T00:51:21.963000",
        "db": "NVD",
        "id": "CVE-2014-0665"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201401-326"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Cisco Identity Services Engine Software of  RBAC Vulnerability in which important information is obtained in the implementation of",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-001069"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "permissions and access control",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201401-326"
      }
    ],
    "trust": 0.6
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.