Details of VAR-201901-0591

ID

VAR-201901-0591

CVE

CVE-2018-15459

TITLE

Cisco Identity Services Engine Access control vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2018-013680

DESCRIPTION

A vulnerability in the administrative web interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to gain additional privileges on an affected device. The vulnerability is due to improper controls on certain pages in the web interface. An attacker could exploit this vulnerability by authenticating to the device with an administrator account and sending a crafted HTTP request. A successful exploit could allow the attacker to create additional Admin accounts with different user roles. An attacker could then use these accounts to perform actions within their scope. The attacker would need valid Admin credentials for the device. This vulnerability cannot be exploited to add a Super Admin account. Cisco Identity Services Engine is prone to a privilege-escalation vulnerability. This issue is being tracked by Cisco Bug ID CSCvi44041. The platform monitors the network by collecting real-time information on the network, users and devices, and formulating and implementing corresponding policies

Trust: 1.98

sources: NVD: CVE-2018-15459 // JVNDB: JVNDB-2018-013680 // BID: 106707 // VULHUB: VHN-125720

AFFECTED PRODUCTS

vendor:	cisco	model:	identity services engine	scope:	eq	version:	2.3\(0.298\)	Trust: 1.0
vendor:	cisco	model:	identity services engine	scope:	eq	version:	2.5\(0.1\)	Trust: 1.0
vendor:	cisco	model:	identity services engine software	scope:	-	version:	-	Trust: 0.8
vendor:	cisco	model:	identity services engine	scope:	eq	version:	2.2.1	Trust: 0.3
vendor:	cisco	model:	identity services engine	scope:	eq	version:	0	Trust: 0.3
vendor:	cisco	model:	identity services engine	scope:	eq	version:	2.3	Trust: 0.3
vendor:	cisco	model:	identity services engine	scope:	eq	version:	2.4	Trust: 0.3
vendor:	cisco	model:	identity services engine	scope:	eq	version:	2.3.0.298	Trust: 0.3
vendor:	cisco	model:	identity services engine patch	scope:	eq	version:	2.2.02	Trust: 0.3
vendor:	cisco	model:	identity services engine	scope:	eq	version:	2.2.0	Trust: 0.3
vendor:	cisco	model:	identity services engine patch	scope:	ne	version:	2.2.11	Trust: 0.3
vendor:	cisco	model:	identity services engine patch	scope:	ne	version:	2.210	Trust: 0.3
vendor:	cisco	model:	identity services engine patch	scope:	ne	version:	2.42	Trust: 0.3
vendor:	cisco	model:	identity services engine patch	scope:	ne	version:	2.35	Trust: 0.3

sources: BID: 106707 // JVNDB: JVNDB-2018-013680 // NVD: CVE-2018-15459

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2018-15459
value:	HIGH
Trust: 1.0
ykramarz@cisco.com:	CVE-2018-15459
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2018-15459
value:	HIGH
Trust: 0.8
CNNVD:	CNNVD-201901-848
value:	HIGH
Trust: 0.6
VULHUB:	VHN-125720
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2018-15459
severity:	MEDIUM
baseScore:	6.5
vectorString:	AV:N/AC:L/AU:S/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	8.0
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
VULHUB:	VHN-125720
severity:	MEDIUM
baseScore:	6.5
vectorString:	AV:N/AC:L/AU:S/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	8.0
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2018-15459
baseSeverity:	HIGH
baseScore:	7.2
vectorString:	CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	HIGH
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	1.2
impactScore:	5.9
version:	3.0
Trust: 1.8
ykramarz@cisco.com:	CVE-2018-15459
baseSeverity:	MEDIUM
baseScore:	6.5
vectorString:	CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	HIGH
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	NONE
exploitabilityScore:	1.2
impactScore:	5.2
version:	3.0
Trust: 1.0

sources: VULHUB: VHN-125720 // JVNDB: JVNDB-2018-013680 // CNNVD: CNNVD-201901-848 // NVD: CVE-2018-15459 // NVD: CVE-2018-15459

PROBLEMTYPE DATA

problemtype:	CWE-284	Trust: 1.9
problemtype:	NVD-CWE-noinfo	Trust: 1.0

sources: VULHUB: VHN-125720 // JVNDB: JVNDB-2018-013680 // NVD: CVE-2018-15459

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201901-848

TYPE

access control error

Trust: 0.6

sources: CNNVD: CNNVD-201901-848

CONFIGURATIONS

sources: JVNDB: JVNDB-2018-013680

PATCH

title:	cisco-sa-20190123-ise-privilege	url:	https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190123-ise-privilege	Trust: 0.8
title:	Cisco Identity Services Engine Fixes for access control error vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=88930	Trust: 0.6

sources: JVNDB: JVNDB-2018-013680 // CNNVD: CNNVD-201901-848

EXTERNAL IDS

db:	NVD	id:	CVE-2018-15459	Trust: 2.8
db:	BID	id:	106707	Trust: 2.0
db:	JVNDB	id:	JVNDB-2018-013680	Trust: 0.8
db:	CNNVD	id:	CNNVD-201901-848	Trust: 0.7
db:	VULHUB	id:	VHN-125720	Trust: 0.1

sources: VULHUB: VHN-125720 // BID: 106707 // JVNDB: JVNDB-2018-013680 // CNNVD: CNNVD-201901-848 // NVD: CVE-2018-15459

REFERENCES

url:	http://www.securityfocus.com/bid/106707	Trust: 2.3
url:	https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20190123-ise-privilege	Trust: 2.0
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-15459	Trust: 0.8
url:	https://nvd.nist.gov/vuln/detail/cve-2018-15459	Trust: 0.8
url:	http://www.cisco.com/	Trust: 0.3
url:	http://www.cisco.com/en/us/products/ps11640/	Trust: 0.3

sources: VULHUB: VHN-125720 // BID: 106707 // JVNDB: JVNDB-2018-013680 // CNNVD: CNNVD-201901-848 // NVD: CVE-2018-15459

CREDITS

This vulnerability was found during internal security testing.,Cisco

Trust: 0.6

sources: CNNVD: CNNVD-201901-848

SOURCES

db:	VULHUB	id:	VHN-125720
db:	BID	id:	106707
db:	JVNDB	id:	JVNDB-2018-013680
db:	CNNVD	id:	CNNVD-201901-848
db:	NVD	id:	CVE-2018-15459

LAST UPDATE DATE

2024-08-14T14:04:38.811000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-125720	date:	2019-10-09T00:00:00
db:	BID	id:	106707	date:	2019-01-23T00:00:00
db:	JVNDB	id:	JVNDB-2018-013680	date:	2019-02-28T00:00:00
db:	CNNVD	id:	CNNVD-201901-848	date:	2019-10-17T00:00:00
db:	NVD	id:	CVE-2018-15459	date:	2019-10-09T23:35:40.953

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-125720	date:	2019-01-23T00:00:00
db:	BID	id:	106707	date:	2019-01-23T00:00:00
db:	JVNDB	id:	JVNDB-2018-013680	date:	2019-02-28T00:00:00
db:	CNNVD	id:	CNNVD-201901-848	date:	2019-01-24T00:00:00
db:	NVD	id:	CVE-2018-15459	date:	2019-01-23T22:29:00.447