CVE-2018-15459

A vulnerability in the administrative web interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to gain additional privileges on an affected device. The vulnerability is due to improper controls on certain pages in the web interface. An attacker could exploit this vulnerability by authenticating to the device with an administrator account and sending a crafted HTTP request. A successful exploit could allow the attacker to create additional Admin accounts with different user roles. An attacker could then use these accounts to perform actions within their scope. The attacker would need valid Admin credentials for the device. This vulnerability cannot be exploited to add a Super Admin account.

• CWE-284

• http://www.securityfocus.com/bid/106707Third Party Advisory
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190123-ise-privilegeVendor Advisory
• http://www.securityfocus.com/bid/106707Third Party Advisory
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190123-ise-privilegeVendor Advisory

Published

Jan 23, 2019

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-15453A vulnerability in the Secure/Multipurpose Internet Mail Ext…8.6
• CVE-2018-15454A vulnerability in the Session Initiation Protocol (SIP) ins…8.6
• CVE-2018-15455A vulnerability in the logging component of Cisco Identity S…6.1
• CVE-2018-15456A vulnerability in the Admin Portal of Cisco Identity Servic…4.3
• CVE-2018-15457A vulnerability in the web-based management interface of Cis…6.1
• CVE-2018-15458A vulnerability in the Shell Access Filter feature of Cisco …5.3
• CVE-2018-1546IBM API Connect 5.0.0.0 through 5.0.8.3 could allow a remote…5.9
• CVE-2018-15460A vulnerability in the email message filtering feature of Ci…8.6
• CVE-2018-15461A vulnerability in the MyWebex component of Cisco Webex Busi…6.1
• CVE-2018-15462A vulnerability in the TCP ingress handler for the data inte…7.5
• CVE-2018-15463A vulnerability in the web-based management interface of Cis…6.1
• CVE-2018-15464A vulnerability in Cisco 900 Series Aggregation Services Rou…5.8