Sign-up

ID

VAR-202011-0729


CVE

CVE-2020-27122


TITLE

Cisco Identity Services Engine  Vulnerability in privilege management

Trust: 0.8

sources: JVNDB: JVNDB-2020-013391

DESCRIPTION

A vulnerability in the Microsoft Active Directory integration of Cisco Identity Services Engine (ISE) could allow an authenticated, local attacker to elevate privileges on an affected device. To exploit this vulnerability, an attacker would need to have a valid administrator account on an affected device. The vulnerability is due to incorrect privilege assignment. An attacker could exploit this vulnerability by logging in to the system with a crafted Active Directory account. A successful exploit could allow the attacker to obtain root privileges on an affected device. Cisco Identity Services Engine (ISE) is an identity-based context-aware platform (ISE Identity Services Engine) from Cisco. The platform monitors the network by collecting real-time information on the network, users and devices, and formulating and implementing corresponding policies

Trust: 1.71

sources: NVD: CVE-2020-27122 // JVNDB: JVNDB-2020-013391 // VULHUB: VHN-370491

AFFECTED PRODUCTS

vendor:ciscomodel:identity services enginescope:ltversion:3.0.0

Trust: 1.0

vendor:シスコシステムズmodel:cisco identity services engine ソフトウェアscope:eqversion: -

Trust: 0.8

vendor:シスコシステムズmodel:cisco identity services engine ソフトウェアscope:eqversion:cisco identity services engine software

Trust: 0.8

sources: JVNDB: JVNDB-2020-013391 // NVD: CVE-2020-27122

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2020-27122
value: MEDIUM

Trust: 1.0

ykramarz@cisco.com: CVE-2020-27122
value: MEDIUM

Trust: 1.0

NVD: CVE-2020-27122
value: MEDIUM

Trust: 0.8

CNNVD: CNNVD-202011-314
value: MEDIUM

Trust: 0.6

VULHUB: VHN-370491
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2020-27122
severity: HIGH
baseScore: 7.2
vectorString: AV:L/AC:L/AU:N/C:C/I:C/A:C
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 3.9
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-370491
severity: HIGH
baseScore: 7.2
vectorString: AV:L/AC:L/AU:N/C:C/I:C/A:C
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 3.9
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2020-27122
baseSeverity: MEDIUM
baseScore: 6.7
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 0.8
impactScore: 5.9
version: 3.1

Trust: 1.0

ykramarz@cisco.com: CVE-2020-27122
baseSeverity: MEDIUM
baseScore: 4.4
vectorString: CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: HIGH
availabilityImpact: NONE
exploitabilityScore: 0.8
impactScore: 3.6
version: 3.0

Trust: 1.0

NVD: CVE-2020-27122
baseSeverity: MEDIUM
baseScore: 6.7
vectorString: CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: VULHUB: VHN-370491 // JVNDB: JVNDB-2020-013391 // CNNVD: CNNVD-202011-314 // NVD: CVE-2020-27122 // NVD: CVE-2020-27122

PROBLEMTYPE DATA

problemtype:CWE-269

Trust: 1.1

problemtype:CWE-266

Trust: 1.0

problemtype:Improper authority management (CWE-269) [NVD Evaluation ]

Trust: 0.8

sources: VULHUB: VHN-370491 // JVNDB: JVNDB-2020-013391 // NVD: CVE-2020-27122

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-202011-314

TYPE

authorization issue

Trust: 0.6

sources: CNNVD: CNNVD-202011-314

PATCH

title:cisco-sa-ise-priv-esc-fNZX8hHjurl:https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-priv-esc-fNZX8hHj

Trust: 0.8

sources: JVNDB: JVNDB-2020-013391

EXTERNAL IDS

db:NVDid:CVE-2020-27122

Trust: 2.5

db:JVNDBid:JVNDB-2020-013391

Trust: 0.8

db:CNNVDid:CNNVD-202011-314

Trust: 0.7

db:AUSCERTid:ESB-2020.3818

Trust: 0.6

db:AUSCERTid:ESB-2020.3818.3

Trust: 0.6

db:CNVDid:CNVD-2020-61951

Trust: 0.1

db:VULHUBid:VHN-370491

Trust: 0.1

sources: VULHUB: VHN-370491 // JVNDB: JVNDB-2020-013391 // CNNVD: CNNVD-202011-314 // NVD: CVE-2020-27122

REFERENCES

url:https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-ise-priv-esc-fnzx8hhj

Trust: 1.7

url:https://nvd.nist.gov/vuln/detail/cve-2020-27122

Trust: 1.4

url:https://www.auscert.org.au/bulletins/esb-2020.3818.3/

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2020.3818/

Trust: 0.6

sources: VULHUB: VHN-370491 // JVNDB: JVNDB-2020-013391 // CNNVD: CNNVD-202011-314 // NVD: CVE-2020-27122

SOURCES

db:VULHUBid:VHN-370491
db:JVNDBid:JVNDB-2020-013391
db:CNNVDid:CNNVD-202011-314
db:NVDid:CVE-2020-27122

LAST UPDATE DATE

2024-08-14T13:54:25.850000+00:00


SOURCES UPDATE DATE

db:VULHUBid:VHN-370491date:2020-11-20T00:00:00
db:JVNDBid:JVNDB-2020-013391date:2021-06-29T08:35:00
db:CNNVDid:CNNVD-202011-314date:2020-12-23T00:00:00
db:NVDid:CVE-2020-27122date:2020-11-20T16:51:25.437

SOURCES RELEASE DATE

db:VULHUBid:VHN-370491date:2020-11-06T00:00:00
db:JVNDBid:JVNDB-2020-013391date:2021-06-29T00:00:00
db:CNNVDid:CNNVD-202011-314date:2020-11-04T00:00:00
db:NVDid:CVE-2020-27122date:2020-11-06T19:15:13.487