Details of VAR-202110-0240

ID

VAR-202110-0240

CVE

CVE-2021-34702

TITLE

Cisco Identity Services Engine Security hole

Trust: 0.6

sources: CNNVD: CNNVD-202110-300

DESCRIPTION

A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to obtain sensitive information. This vulnerability is due to improper enforcement of administrator privilege levels for low-value sensitive data. An attacker with read-only administrator access to the web-based management interface could exploit this vulnerability by browsing to the page that contains the sensitive data. A successful exploit could allow the attacker to collect sensitive information regarding the configuration of the system

Trust: 1.08

sources: NVD: CVE-2021-34702 // VULHUB: VHN-394944 // VULMON: CVE-2021-34702

AFFECTED PRODUCTS

vendor:	cisco	model:	identity services engine	scope:	lt	version:	2.6.0	Trust: 1.0
vendor:	cisco	model:	identity services engine	scope:	gte	version:	2.2.0	Trust: 1.0
vendor:	cisco	model:	identity services engine	scope:	eq	version:	3.0.0	Trust: 1.0
vendor:	cisco	model:	identity services engine	scope:	eq	version:	2.7.0	Trust: 1.0
vendor:	cisco	model:	identity services engine	scope:	eq	version:	2.6.0	Trust: 1.0

sources: NVD: CVE-2021-34702

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2021-34702
value:	MEDIUM
Trust: 1.0
ykramarz@cisco.com:	CVE-2021-34702
value:	MEDIUM
Trust: 1.0
CNNVD:	CNNVD-202110-300
value:	MEDIUM
Trust: 0.6
VULHUB:	VHN-394944
value:	MEDIUM
Trust: 0.1
VULMON:	CVE-2021-34702
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2021-34702
severity:	MEDIUM
baseScore:	4.0
vectorString:	AV:N/AC:L/AU:S/C:P/I:N/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	8.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.1
VULHUB:	VHN-394944
severity:	MEDIUM
baseScore:	4.0
vectorString:	AV:N/AC:L/AU:S/C:P/I:N/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	8.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2021-34702
baseSeverity:	MEDIUM
baseScore:	4.3
vectorString:	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	LOW
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	2.8
impactScore:	1.4
version:	3.1
Trust: 2.0

sources: VULHUB: VHN-394944 // VULMON: CVE-2021-34702 // CNNVD: CNNVD-202110-300 // NVD: CVE-2021-34702 // NVD: CVE-2021-34702

PROBLEMTYPE DATA

problemtype:	CWE-200	Trust: 1.0
problemtype:	NVD-CWE-Other	Trust: 1.0

sources: NVD: CVE-2021-34702

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202110-300

TYPE

other

Trust: 0.6

sources: CNNVD: CNNVD-202110-300

PATCH

title:	Cisco Identity Services Engine Repair measures for information disclosure vulnerabilities	url:	http://123.124.177.30/web/xxk/bdxqById.tag?id=164975	Trust: 0.6
title:	Cisco: Cisco Identity Services Engine Sensitive Information Disclosure Vulnerability	url:	https://vulmon.com/vendoradvisory?qidtp=cisco_security_advisories_and_alerts_ciscoproducts&qid=cisco-sa-ise-info-disc-pNXtLhdp	Trust: 0.1
title:	-	url:	https://github.com/Live-Hack-CVE/CVE-2021-34702	Trust: 0.1

sources: VULMON: CVE-2021-34702 // CNNVD: CNNVD-202110-300

EXTERNAL IDS

db:	NVD	id:	CVE-2021-34702	Trust: 1.8
db:	CS-HELP	id:	SB2021100708	Trust: 0.6
db:	AUSCERT	id:	ESB-2021.3316	Trust: 0.6
db:	CNNVD	id:	CNNVD-202110-300	Trust: 0.6
db:	VULHUB	id:	VHN-394944	Trust: 0.1
db:	VULMON	id:	CVE-2021-34702	Trust: 0.1

sources: VULHUB: VHN-394944 // VULMON: CVE-2021-34702 // CNNVD: CNNVD-202110-300 // NVD: CVE-2021-34702

REFERENCES

url:	https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-ise-info-disc-pnxtlhdp	Trust: 2.5
url:	https://nvd.nist.gov/vuln/detail/cve-2021-34702	Trust: 0.6
url:	https://www.cybersecurity-help.cz/vdb/sb2021100708	Trust: 0.6
url:	https://www.auscert.org.au/bulletins/esb-2021.3316	Trust: 0.6
url:	https://cwe.mitre.org/data/definitions/.html	Trust: 0.1
url:	https://github.com/live-hack-cve/cve-2021-34702	Trust: 0.1
url:	https://nvd.nist.gov	Trust: 0.1

sources: VULHUB: VHN-394944 // VULMON: CVE-2021-34702 // CNNVD: CNNVD-202110-300 // NVD: CVE-2021-34702

SOURCES

db:	VULHUB	id:	VHN-394944
db:	VULMON	id:	CVE-2021-34702
db:	CNNVD	id:	CNNVD-202110-300
db:	NVD	id:	CVE-2021-34702

LAST UPDATE DATE

2024-08-14T14:31:37.234000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-394944	date:	2022-10-25T00:00:00
db:	VULMON	id:	CVE-2021-34702	date:	2022-10-25T00:00:00
db:	CNNVD	id:	CNNVD-202110-300	date:	2022-10-26T00:00:00
db:	NVD	id:	CVE-2021-34702	date:	2023-11-07T03:36:06.933

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-394944	date:	2021-10-06T00:00:00
db:	VULMON	id:	CVE-2021-34702	date:	2021-10-06T00:00:00
db:	CNNVD	id:	CNNVD-202110-300	date:	2021-10-06T00:00:00
db:	NVD	id:	CVE-2021-34702	date:	2021-10-06T20:15:08.777