CVE-2019-1659: Cisco Prime Infrastructure Certificate Validation Vulnerability
First published: Thu Feb 21 2019(Updated: )
A vulnerability in the Identity Services Engine (ISE) integration feature of Cisco Prime Infrastructure (PI) could allow an unauthenticated, remote attacker to perform a man-in-the-middle attack against the Secure Sockets Layer (SSL) tunnel established between ISE and PI. The vulnerability is due to improper validation of the server SSL certificate when establishing the SSL tunnel with ISE. An attacker could exploit this vulnerability by using a crafted SSL certificate and could then intercept communications between the ISE and PI. A successful exploit could allow the attacker to view and alter potentially sensitive information that the ISE maintains about clients that are connected to the network. This vulnerability affects Cisco Prime Infrastructure Software Releases 2.2 through 3.4.0 when the PI server is integrated with ISE, which is disabled by default.
Credit: ykramarz@cisco.com ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco Prime Infrastructure | >=2.2<=3.4.0 | |
| >=2.2<=3.4.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2019-1659.
What is the severity of CVE-2019-1659?
The severity of CVE-2019-1659 is high with a CVSS score of 7.4.
What is the affected software for CVE-2019-1659?
The affected software for CVE-2019-1659 is Cisco Prime Infrastructure version 2.2 to 3.4.0.
What is the impact of CVE-2019-1659?
The vulnerability allows an unauthenticated, remote attacker to perform a man-in-the-middle attack against the SSL tunnel between Identity Services Engine (ISE) and Cisco Prime Infrastructure (PI).
Are there any recommended patches or solutions for CVE-2019-1659?
Cisco has released a security advisory that provides information on how to mitigate the vulnerability in Cisco Prime Infrastructure. Please refer to the Cisco Security Advisory for more details.
- collector/nvd-index
- agent/references
- agent/type
- agent/severity
- agent/weakness
- agent/title
- agent/description
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/last-modified-date
- agent/author
- agent/softwarecombine
- agent/tags
- agent/event
- vendor/cisco
- canonical/cisco prime infrastructure
- version/cisco prime infrastructure/2.2
- version/cisco prime infrastructure/3.4.0