CVE-2023-20087

Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to download arbitrary files from the filesystem of an affected device. These vulnerabilities are due to insufficient input validation. An attacker could exploit these vulnerabilities by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to download arbitrary files from the underlying filesystem of the affected device.

• CWE-37
• CWE-22

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-file-dwnld-Srcdnkd2Vendor Advisory
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-file-dwnld-Srcdnkd2Vendor Advisory

Published

May 18, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-20081A vulnerability in the IPv6 DHCP (DHCPv6) client module of C…5.9
• CVE-2023-20082A vulnerability in Cisco IOS XE Software for Cisco Catalyst …6.8
• CVE-2023-20083A vulnerability in ICMPv6 inspection when configured with th…8.6
• CVE-2023-20084A vulnerability in the endpoint software of Cisco Secure End…4.4
• CVE-2023-20085A vulnerability in the web-based management interface of Cis…6.1
• CVE-2023-20086A vulnerability in ICMPv6 processing of Cisco Adaptive Secur…8.6
• CVE-2023-20088A vulnerability in the nginx configurations that are provide…7.5
• CVE-2023-20089A vulnerability in the Link Layer Discovery Protocol (LLDP) …6.5
• CVE-2023-2009Plugin does not sanitize and escape the URL field in the Pre…4.8
• CVE-2023-20090A vulnerability in Cisco TelePresence CE and RoomOS could al…6.7
• CVE-2023-20091A vulnerability in the CLI of Cisco TelePresence CE and Room…5.1
• CVE-2023-20092Three vulnerabilities in the CLI of Cisco TelePresence CE an…4.4