Vulnerability-Lookup

WID-SEC-W-2024-2052

Vulnerability from csaf_certbund - Published: 2024-09-04 22:00 - Updated: 2024-09-04 22:00

Summary

Cisco Identity Services Engine (ISE): Schwachstelle ermöglicht Privilegieneskalation

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung

Die Cisco Identity Services Engine (ISE) bietet eine attributbasierte Zugangs-Kontroll-Lösung.

Angriff

Ein lokaler Angreifer kann eine Schwachstelle in Cisco Identity Services Engine (ISE) ausnutzen, um seine Privilegien zu erhöhen.

Betroffene Betriebssysteme

- Sonstiges

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "mittel"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Die Cisco Identity Services Engine (ISE) bietet eine attributbasierte Zugangs-Kontroll-L\u00f6sung.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein lokaler Angreifer kann eine Schwachstelle in Cisco Identity Services Engine (ISE) ausnutzen, um seine Privilegien zu erh\u00f6hen.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Sonstiges",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2024-2052 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2024/wid-sec-w-2024-2052.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2024-2052 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2024-2052"
      },
      {
        "category": "external",
        "summary": "Cisco Security Advisory vom 2024-09-04",
        "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-injection-6kn9tSxm"
      }
    ],
    "source_lang": "en-US",
    "title": "Cisco Identity Services Engine (ISE): Schwachstelle erm\u00f6glicht Privilegieneskalation",
    "tracking": {
      "current_release_date": "2024-09-04T22:00:00.000+00:00",
      "generator": {
        "date": "2024-09-05T09:38:14.359+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.3.6"
        }
      },
      "id": "WID-SEC-W-2024-2052",
      "initial_release_date": "2024-09-04T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2024-09-04T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003e3.1",
                "product": {
                  "name": "Cisco Identity Services Engine (ISE) \u003e3.1",
                  "product_id": "T025194"
                }
              },
              {
                "category": "product_version",
                "name": "3.1",
                "product": {
                  "name": "Cisco Identity Services Engine (ISE) 3.1",
                  "product_id": "T025194-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:cisco:identity_services_engine_software:3.1"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c3.2P7",
                "product": {
                  "name": "Cisco Identity Services Engine (ISE) \u003c3.2P7",
                  "product_id": "T037285"
                }
              },
              {
                "category": "product_version",
                "name": "3.2P7",
                "product": {
                  "name": "Cisco Identity Services Engine (ISE) 3.2P7",
                  "product_id": "T037285-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:cisco:identity_services_engine_software:3.2p7"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c3.3P4",
                "product": {
                  "name": "Cisco Identity Services Engine (ISE) \u003c3.3P4",
                  "product_id": "T037286"
                }
              },
              {
                "category": "product_version",
                "name": "3.3P4",
                "product": {
                  "name": "Cisco Identity Services Engine (ISE) 3.3P4",
                  "product_id": "T037286-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:cisco:identity_services_engine_software:3.3p4"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c3.4",
                "product": {
                  "name": "Cisco Identity Services Engine (ISE) \u003c3.4",
                  "product_id": "T037287"
                }
              },
              {
                "category": "product_version",
                "name": "3.4",
                "product": {
                  "name": "Cisco Identity Services Engine (ISE) 3.4",
                  "product_id": "T037287-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:cisco:identity_services_engine_software:3.4"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Identity Services Engine (ISE)"
          }
        ],
        "category": "vendor",
        "name": "Cisco"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-20469",
      "notes": [
        {
          "category": "description",
          "text": "Es besteht eine Schwachstelle in der Cisco Identity Services Engine (ISE). Dieser Fehler entsteht wegen einer unzureichenden Validierung der vom Benutzer bereitgestellten Eingaben. Durch die \u00dcbermittlung eines manipulierten CLI-Befehls kann ein lokaler Angreifer mit Administratorrechten diese Schwachstelle ausnutzen, um seine Privilegien zu root zu erweitern."
        }
      ],
      "product_status": {
        "known_affected": [
          "T037285",
          "T037286",
          "T037287"
        ]
      },
      "release_date": "2024-09-04T22:00:00.000+00:00",
      "title": "CVE-2024-20469"
    }
  ]
}

CVE-2024-20469 (GCVE-0-2024-20469)

Vulnerability from cvelistv5 – Published: 2024-09-04 16:28 – Updated: 2024-09-06 03:55

Title

Cisco Identity Services Engine Command Injection Vulnerability

Summary

A vulnerability in specific CLI commands in Cisco Identity Services Engine (ISE) could allow an authenticated, local attacker to perform command injection attacks on the underlying operating system and elevate privileges to root. To exploit this vulnerability, the attacker must have valid Administrator privileges on an affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by submitting a crafted CLI command. A successful exploit could allow the attacker to elevate privileges to root.

Severity ?

6 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

CWE

CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Assigner

cisco

References

URL

Tags

https://sec.cloudapps.cisco.com/security/center/c…

Impacted products

	Vendor	Product	Version
	Cisco	Cisco Identity Services Engine Software	Affected: 3.2.0 Affected: 3.2.0 p1 Affected: 3.2.0 p2 Affected: 3.3.0 Affected: 3.2.0 p3 Affected: 3.2.0 p4 Affected: 3.2.0 p5 Affected: 3.2.0 p6 Affected: 3.3 Patch 2 Affected: 3.3 Patch 1 Affected: 3.3 Patch 3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:cisco:identity_services_engine_software:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "identity_services_engine_software",
            "vendor": "cisco",
            "versions": [
              {
                "status": "affected",
                "version": "3.2.0"
              },
              {
                "status": "affected",
                "version": "3.2.0p1"
              },
              {
                "status": "affected",
                "version": "3.2.0p2"
              },
              {
                "status": "affected",
                "version": "3.2.0p3"
              },
              {
                "status": "affected",
                "version": "3.2.0p4"
              },
              {
                "status": "affected",
                "version": "3.2.0p5"
              },
              {
                "status": "affected",
                "version": "3.2.0p6"
              },
              {
                "status": "affected",
                "version": "3.3.0"
              },
              {
                "status": "affected",
                "version": "3.3p1"
              },
              {
                "status": "affected",
                "version": "3.3p2"
              },
              {
                "status": "affected",
                "version": "3.3p3"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-20469",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-05T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-06T03:55:19.640Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Cisco Identity Services Engine Software",
          "vendor": "Cisco",
          "versions": [
            {
              "status": "affected",
              "version": "3.2.0"
            },
            {
              "status": "affected",
              "version": "3.2.0 p1"
            },
            {
              "status": "affected",
              "version": "3.2.0 p2"
            },
            {
              "status": "affected",
              "version": "3.3.0"
            },
            {
              "status": "affected",
              "version": "3.2.0 p3"
            },
            {
              "status": "affected",
              "version": "3.2.0 p4"
            },
            {
              "status": "affected",
              "version": "3.2.0 p5"
            },
            {
              "status": "affected",
              "version": "3.2.0 p6"
            },
            {
              "status": "affected",
              "version": "3.3 Patch 2"
            },
            {
              "status": "affected",
              "version": "3.3 Patch 1"
            },
            {
              "status": "affected",
              "version": "3.3 Patch 3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability in specific CLI commands in Cisco Identity Services Engine (ISE) could allow an authenticated, local attacker to perform command injection attacks on the underlying operating system and elevate privileges to root. To exploit this vulnerability, the attacker must have valid Administrator privileges on an affected device.\r\n\r\nThis vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by submitting a crafted CLI command. A successful exploit could allow the attacker to elevate privileges to root."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "value": "The Cisco PSIRT is aware that proof-of-concept exploit code is available for the vulnerability that is described in this advisory.\r\n\r\nThe Cisco PSIRT is not aware of any malicious use of the vulnerability that is described in this advisory."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 6,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "cvssV3_1"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "cwe"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-09-04T16:28:56.583Z",
        "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
        "shortName": "cisco"
      },
      "references": [
        {
          "name": "cisco-sa-ise-injection-6kn9tSxm",
          "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-injection-6kn9tSxm"
        }
      ],
      "source": {
        "advisory": "cisco-sa-ise-injection-6kn9tSxm",
        "defects": [
          "CSCwj97491"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Cisco Identity Services Engine Command Injection Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
    "assignerShortName": "cisco",
    "cveId": "CVE-2024-20469",
    "datePublished": "2024-09-04T16:28:56.583Z",
    "dateReserved": "2023-11-08T15:08:07.681Z",
    "dateUpdated": "2024-09-06T03:55:19.640Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

WID-SEC-W-2024-2052

CVE-2024-20469 (GCVE-0-2024-20469)

Tags

Sightings

Nomenclature