{"dataType": "CVE_RECORD", "dataVersion": "5.0", "cveMetadata": {"cveId": "CVE-2022-20965", "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "state": "PUBLISHED", "assignerShortName": "cisco", "dateReserved": "2021-11-02T13:28:29.197Z", "datePublished": "2023-01-18T17:44:34.798Z", "dateUpdated": "2024-01-25T16:57:27.232Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "shortName": "cisco", "dateUpdated": "2024-01-25T16:57:27.232Z"}, "descriptions": [{"lang": "en", "value": "A vulnerability in the web-based management interface of Cisco Identity Services Engine could allow an authenticated, remote attacker to take privileges actions within the web-based management interface.\r\n\r This vulnerability is due to improper access control on a feature within the web-based management interface of the affected system. An attacker could exploit this vulnerability by accessing features through direct requests, bypassing checks within the application. A successful exploit could allow the attacker to take privileged actions within the web-based management interface that should be otherwise restricted.\r\n\r \r\n\r {{value}} [\"%7b%7bvalue%7d%7d\"])}]]\r\n"}], "affected": [{"vendor": "Cisco", "product": "Cisco Identity Services Engine Software", "versions": [{"version": "2.6.0", "status": "affected"}, {"version": "2.6.0 p1", "status": "affected"}, {"version": "2.6.0 p2", "status": "affected"}, {"version": "2.6.0 p3", "status": "affected"}, {"version": "2.6.0 p5", "status": "affected"}, {"version": "2.6.0 p6", "status": "affected"}, {"version": "2.6.0 p7", "status": "affected"}, {"version": "2.6.0 p8", "status": "affected"}, {"version": "2.6.0 p9", "status": "affected"}, {"version": "2.6.0 p10", "status": "affected"}, {"version": "2.6.0 p11", "status": "affected"}, {"version": "2.6.0 p12", "status": "affected"}, {"version": "2.7.0", "status": "affected"}, {"version": "2.7.0 p1", "status": "affected"}, {"version": "2.7.0 p2", "status": "affected"}, {"version": "2.7.0 p3", "status": "affected"}, {"version": "2.7.0 p4", "status": "affected"}, {"version": "2.7.0 p5", "status": "affected"}, {"version": "2.7.0 p6", "status": "affected"}, {"version": "2.7.0 p7", "status": "affected"}, {"version": "3.0.0", "status": "affected"}, {"version": "3.0.0 p1", "status": "affected"}, {"version": "3.0.0 p2", "status": "affected"}, {"version": "3.0.0 p3", "status": "affected"}, {"version": "3.0.0 p4", "status": "affected"}, {"version": "3.0.0 p5", "status": "affected"}, {"version": "3.0.0 p6", "status": "affected"}, {"version": "3.1.0", "status": "affected"}, {"version": "3.1.0 p1", "status": "affected"}, {"version": "3.1.0 p3", "status": "affected"}, {"version": "3.1.0 p4", "status": "affected"}, {"version": "3.1.0 p5", "status": "affected"}, {"version": "3.2.0", "status": "affected"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Incorrect Use of Privileged APIs", "type": "cwe", "cweId": "CWE-648"}]}], "references": [{"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-7Q4TNYUx", "name": "cisco-sa-ise-7Q4TNYUx"}], "metrics": [{"format": "cvssV3_1", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "NONE"}}], "exploits": [{"lang": "en", "value": "The Cisco PSIRT is aware that proof-of-concept exploit code is available for the vulnerabilities that are described in this advisory.\r\n\r\nThe Cisco PSIRT is not aware of any malicious use of the vulnerabilities that are described in this advisory."}], "source": {"advisory": "cisco-sa-ise-7Q4TNYUx", "discovery": "EXTERNAL", "defects": ["CSCwc98828"]}}}}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:cisco:identity_services_engine:*:*:*:*:*:*:*:*", "matchCriteriaId": "776397EC-F775-4068-A811-D57FC2DDAF8C", "versionEndExcluding": "2.6.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:identity_services_engine:2.6.0:-:*:*:*:*:*:*", "matchCriteriaId": "8B45856E-6BE4-40A7-AE2F-4F9DC9315875", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:identity_services_engine:2.6.0:patch1:*:*:*:*:*:*", "matchCriteriaId": "1F6D1780-3306-4481-A3CD-8F7732D955CC", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:identity_services_engine:2.6.0:patch10:*:*:*:*:*:*", "matchCriteriaId": "00756651-F667-4E4A-8024-3EAF003A9B92", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:identity_services_engine:2.6.0:patch11:*:*:*:*:*:*", "matchCriteriaId": "57E9CE5A-219F-4702-9E8A-074ED35BD252", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:identity_services_engine:2.6.0:patch12:*:*:*:*:*:*", "matchCriteriaId": "33C600DA-4F42-415E-8E7D-6A9EC0720252", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:identity_services_engine:2.6.0:patch2:*:*:*:*:*:*", "matchCriteriaId": "07BF9702-0607-49A1-A82A-E4ADF1A4135F", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:identity_services_engine:2.6.0:patch3:*:*:*:*:*:*", "matchCriteriaId": "11AA4EC0-6F3C-45A9-9AA4-0D81876F44B5", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:identity_services_engine:2.6.0:patch5:*:*:*:*:*:*", "matchCriteriaId": "1B4B88F0-3229-4B07-9308-C37C794595A0", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:identity_services_engine:2.6.0:patch6:*:*:*:*:*:*", "matchCriteriaId": "E02F0E61-FBFF-4C6D-9132-E266FF67802B", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:identity_services_engine:2.6.0:patch7:*:*:*:*:*:*", "matchCriteriaId": "541EC483-540A-4080-AA69-82A0F30EE3D6", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:identity_services_engine:2.6.0:patch8:*:*:*:*:*:*", "matchCriteriaId": "66CAFE97-295F-48F7-A92C-A90D3B837483", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:identity_services_engine:2.6.0:patch9:*:*:*:*:*:*", "matchCriteriaId": "68E172B4-867E-4413-9D45-F04B52270D41", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:identity_services_engine:2.7.0:-:*:*:*:*:*:*", "matchCriteriaId": "1F22FABF-2831-4895-B0A9-283B98398F43", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:identity_services_engine:2.7.0:patch1:*:*:*:*:*:*", "matchCriteriaId": "B83D0F20-5A43-4583-AFAF-CD9D20352437", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:identity_services_engine:2.7.0:patch2:*:*:*:*:*:*", "matchCriteriaId": "2887A2C0-BADA-41D3-AA6A-F10BC58AA7F9", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:identity_services_engine:2.7.0:patch3:*:*:*:*:*:*", "matchCriteriaId": "5ADE32BD-C500-47D8-86D6-B08F55F1BBDF", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:identity_services_engine:2.7.0:patch4:*:*:*:*:*:*", "matchCriteriaId": "22F23314-96BE-42F6-AE07-CC13F8856029", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:identity_services_engine:2.7.0:patch5:*:*:*:*:*:*", "matchCriteriaId": "76265489-E5DC-46F1-9475-2FDFCEE32CF4", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:identity_services_engine:2.7.0:patch6:*:*:*:*:*:*", "matchCriteriaId": "9517A1B4-45BA-44DD-9122-C86BF9075EFE", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:identity_services_engine:2.7.0:patch7:*:*:*:*:*:*", "matchCriteriaId": "1BC35A24-68DB-43C5-A817-9B35018F5990", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:identity_services_engine:3.0.0:-:*:*:*:*:*:*", "matchCriteriaId": "A1063044-BCD7-487F-9880-141C30547E36", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:identity_services_engine:3.0.0:patch1:*:*:*:*:*:*", "matchCriteriaId": "DA42E65A-7207-48B8-BE1B-0B352201BC09", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:identity_services_engine:3.0.0:patch2:*:*:*:*:*:*", "matchCriteriaId": "75DDAF38-4D5F-4EE4-A428-68D28FC0DA96", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:identity_services_engine:3.0.0:patch3:*:*:*:*:*:*", "matchCriteriaId": "C5FB6AA6-F8C9-48A6-BDDA-1D25C43564EB", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:identity_services_engine:3.0.0:patch4:*:*:*:*:*:*", "matchCriteriaId": "2B3A267A-5FEA-426D-903E-BD3F4F94A1A4", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:identity_services_engine:3.0.0:patch5:*:*:*:*:*:*", "matchCriteriaId": "B1B3207B-1B9C-41AA-8EF6-8478458462E7", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:identity_services_engine:3.0.0:patch6:*:*:*:*:*:*", "matchCriteriaId": "C5B9E7F3-B0F2-4A6A-B939-A62E9B12CCEB", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:identity_services_engine:3.1:-:*:*:*:*:*:*", "matchCriteriaId": "C4DB9726-532F-45CE-81FD-45F2F6C7CE51", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:identity_services_engine:3.1:patch1:*:*:*:*:*:*", "matchCriteriaId": "2E8F0066-0EC0-41FD-80BE-55C4ED5F6B0E", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:identity_services_engine:3.1:patch3:*:*:*:*:*:*", "matchCriteriaId": "5D1765DB-1BEF-4CE9-8B86-B91F709600EB", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:identity_services_engine:3.1:patch4:*:*:*:*:*:*", "matchCriteriaId": "3D1E80EF-C3FD-4F7A-B63D-0EAA5C878B11", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:identity_services_engine:3.2:-:*:*:*:*:*:*", "matchCriteriaId": "36722B6C-64A5-4D00-94E1-442878C37A35", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability in the web-based management interface of Cisco Identity Services Engine could allow an authenticated, remote attacker to take privileges actions within the web-based management interface.\r\n\r This vulnerability is due to improper access control on a feature within the web-based management interface of the affected system. An attacker could exploit this vulnerability by accessing features through direct requests, bypassing checks within the application. A successful exploit could allow the attacker to take privileged actions within the web-based management interface that should be otherwise restricted.\r\n\r \r\n\r {{value}} [\"%7b%7bvalue%7d%7d\"])}]]\r\n"}], "id": "CVE-2022-20965", "lastModified": "2024-01-25T17:15:23.133", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.5, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "ykramarz@cisco.com", "type": "Secondary"}]}, "published": "2023-01-20T07:15:11.083", "references": [{"source": "ykramarz@cisco.com", "tags": ["Vendor Advisory"], "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-7Q4TNYUx"}], "sourceIdentifier": "ykramarz@cisco.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-648"}], "source": "ykramarz@cisco.com", "type": "Secondary"}]}

{}