CVE-2023-20195
Last modified
CVE-2023-20195 is a high-severity vulnerability rated 7.2/10 on the CVSS scale. Two vulnerabilities in Cisco ISE could allow an authenticated, remote attacker to upload arbitrary files to an affected device. To exploit these vulnerabilities, an attacker must have valid Administrator credentials on the affected device. EPSS estimates a 0.57% chance of exploitation in the next 30 days.
Description
Two vulnerabilities in Cisco ISE could allow an authenticated, remote attacker to upload arbitrary files to an affected device. To exploit these vulnerabilities, an attacker must have valid Administrator credentials on the affected device. These vulnerabilities are due to improper validation of files that are uploaded to the web-based management interface. An attacker could exploit these vulnerabilities by uploading a crafted file to an affected device. A successful exploit could allow the attacker to store malicious files in specific directories on the device. The attacker could later use those files to conduct additional attacks, including executing arbitrary code on the affected device with root privileges.
Metrics
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Cisco | Identity Services Engine | 2.7.0 |
| Cisco | Identity Services Engine | 3.0.0 |
| Cisco | Identity Services Engine | 3.1 |
| Cisco | Identity Services Engine | 3.2 |
References
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2023-20195?
How severe is CVE-2023-20195?
How do I fix CVE-2023-20195?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2023
- CVE-2023-2019A flaw was found in the Linux kernel's netdevsim device driv…4.4
- CVE-2023-20190A vulnerability in the classic access control list (ACL) com…5.3
- CVE-2023-20191A vulnerability in the access control list (ACL) processing …7.5
- CVE-2023-20192Multiple vulnerabilities in Cisco Expressway Series and Cisc…7.7
- CVE-2023-20193A vulnerability in the Embedded Service Router (ESR) of Cisc…6.7
- CVE-2023-20194A vulnerability in the ERS API of Cisco ISE could allow an a…4.9
- CVE-2023-20196Two vulnerabilities in Cisco ISE could allow an authenticate…7.2
- CVE-2023-20197A vulnerability in the filesystem image parser for Hierarchi…7.5
- CVE-2023-20198Cisco is providing an update for the ongoing investigation i…10
- CVE-2023-20199A vulnerability in Cisco Duo Two-Factor Authentication for m…6.6
- CVE-2023-2020Insufficient permission checks in the REST API in Tribe29 Ch…4.3
- CVE-2023-20200A vulnerability in the Simple Network Management Protocol (S…6.3
Are you affected by CVE-2023-20195?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST