CVE-2018-15456
Last modified
CVE-2018-15456 is a medium-severity vulnerability rated 4.3/10 on the CVSS scale. A vulnerability in the Admin Portal of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to view saved passwords in plain text. The vulnerability is due to the incorrect inclusion of saved passwords when loading configuration pages in the Admin Portal. EPSS estimates a 1.28% chance of exploitation in the next 30 days.
Description
A vulnerability in the Admin Portal of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to view saved passwords in plain text. The vulnerability is due to the incorrect inclusion of saved passwords when loading configuration pages in the Admin Portal. An attacker with read or write access to the Admin Portal could exploit this vulnerability by browsing to a page that contains sensitive data. An exploit could allow the attacker to recover passwords for unauthorized use and expose those accounts to further attack.
Metrics
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Cisco | Identity Services Engine | 2.2\(0.470\) |
| Cisco | Identity Services Engine | 2.3\(0.298\) |
| Cisco | Identity Services Engine | 2.4\(0.357\) |
| Cisco | Identity Services Engine | 2.4\(100.159\) |
References
- http://www.securityfocus.com/bid/106512Third Party Advisory, VDB Entry
- http://www.securityfocus.com/bid/106512Third Party Advisory, VDB Entry
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2018-15456?
How severe is CVE-2018-15456?
How do I fix CVE-2018-15456?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2018
- CVE-2018-15450A vulnerability in the web-based UI of Cisco Prime Collabora…6.5
- CVE-2018-15451A vulnerability in the web-based management interface of Cis…5.4
- CVE-2018-15452A vulnerability in the DLL loading component of Cisco Advanc…5.5
- CVE-2018-15453A vulnerability in the Secure/Multipurpose Internet Mail Ext…8.6
- CVE-2018-15454A vulnerability in the Session Initiation Protocol (SIP) ins…8.6
- CVE-2018-15455A vulnerability in the logging component of Cisco Identity S…6.1
- CVE-2018-15457A vulnerability in the web-based management interface of Cis…6.1
- CVE-2018-15458A vulnerability in the Shell Access Filter feature of Cisco …5.3
- CVE-2018-15459A vulnerability in the administrative web interface of Cisco…6.5
- CVE-2018-1546IBM API Connect 5.0.0.0 through 5.0.8.3 could allow a remote…5.9
- CVE-2018-15460A vulnerability in the email message filtering feature of Ci…8.6
- CVE-2018-15461A vulnerability in the MyWebex component of Cisco Webex Busi…6.1
Are you affected by CVE-2018-15456?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST