CVE-2022-20733CWE-287

Cisco Identity Services Engine Authentication Bypass Vulnerability

Medium · published June 15, 2022

CVSS v3.1
5.3
EPSS
1%
Percentile
66.0
In the wild
Unconfirmed
What it is

A vulnerability in the login page of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to log in without credentials and access all roles without any restrictions. This vulnerability is due to exposed sensitive Security Assertion Markup Language (SAML) metadata. An attacker could exploit this vulnerability by using the exposed SAML metadata to bypass authentication to the user portal. A successful exploit could allow the attacker to access all roles without any restrictions.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.01126 · 66.0th percentile
Weakness
CWE-287 · Improper Authentication
Published
2022-06-15T17:55Z
EPSS history
Timeline
  • 15 JUN 17:55Z
    Cisco Identity Services Engine Authentication Bypass Vulnerability
    cvelistv5