CVE-2018-15456
mediumPriorität · verfolgen · 20EPSS 0.013 · 70. PerzentilEURUUSEPSS · bewertet 2026-10-27
A vulnerability in the Admin Portal of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to view saved passwords in plain text. The vulnerability is due to the incorrect inclusion of saved passwords when loading configuration pages in the Admin Portal. An attacker with read or write access to the Admin Portal could exploit this vulnerability by browsing to a page that contains sensitive data. An exploit could allow the attacker to recover passwords for unauthorized use and expose those accounts to further attack.
Behebungen
Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.
Ein Hersteller-Fix ist verfügbar.
- BehobenCisco Identity Services Engine Softwarecisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen
SSVC
Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (10)
Betroffene Produkte und Versionsbereiche.
- cisco identity services engine= 2.2(0.470)nvdUScpe:2.3:a:cisco:identity_services_engine:*:*:*:*:*:*:*:*
- cisco identity services engine= 2.3(0.298)nvdUScpe:2.3:a:cisco:identity_services_engine:*:*:*:*:*:*:*:*
- cisco identity services engine= 2.4(0.357)nvdUScpe:2.3:a:cisco:identity_services_engine:*:*:*:*:*:*:*:*
- cisco identity services engine= 2.4(100.159)nvdUScpe:2.3:a:cisco:identity_services_engine:*:*:*:*:*:*:*:*
Advisories (1)
Hersteller- und Ökosystem-Meldungen dazu.
- cisco-sa-20190109-ise-passwdCisco Identity Services Engine Password Recovery Vulnerability2019-01-09csaf · cisco_csafUS
A vulnerability in the Admin Portal of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to view saved passwords in plain text. The vulnerability is due to the incorrect inclusion of saved passwords when loading configuration pages in the Admin Portal. An attacker with read or write access to the Admin Portal could exploit this vulnerability by browsing to a page that contains sensitive data. An exploit could allow the attacker to recover passwords for unauthorized use and expose those accounts to further attack. There are no workarounds that address this vulnerability. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190109-ise-passwd ["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190109-ise-passwd"]
auch bekannt als (4)
Weitere Namen und Kennungen dieser Entität.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (6)
Externe Belege — Patches, Meldungen, Analysen.
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190109-ise-passwdcnnvd
- https://www.securityfocus.com/bid/106512cnnvd
- http://www.securityfocus.com/bid/106512enisa_euvd
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190109-ise-passwdenisa_euvd
- http://www.securityfocus.com/bid/106512Third Party AdvisoryVDB Entrynvd
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190109-ise-passwdVendor Advisorynvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan