Fiche vulnérabilité
CVE-2024-20476 : faille moyenne cisco identity services engine (CVSS 4.9)
Description
A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to bypass the authorization mechanisms for specific file management functions. This vulnerability is due to lack of server-side validation of Administrator permissions. An attacker could exploit this vulnerability by submitting a crafted HTTP request to an affected system. A successful exploit could allow the attacker to upload files to a location that should be restricted. To exploit this vulnerability, an attacker would need valid Read-Only Administrator credentials.
En bref
- Sévérité
- Moyenne (CVSS 4.9)
- Vecteur CVSS
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
- Exploitation active
- Non signalée par la CISA
- Publication
- 6 nov. 2024
- Dernière mise à jour
- 17 juin 2026
Produits concernés
- cisco identity services engine