CVE-2023-20167: Cisco Identity Services Engine Path Traversal Vulnerabilities
First published: Thu May 18 2023(Updated: )
Multiple vulnerabilities in Cisco Identity Services Engine (ISE) could allow an authenticated attacker to perform path traversal attacks on the underlying operating system to either elevate privileges to root or read arbitrary files. To exploit these vulnerabilities, an attacker must have valid Administrator credentials on the affected device. For more information about these vulnerabilities, see the Details section of this advisory.
Credit: ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco Identity Services Engine | <3.1 | |
| Cisco Identity Services Engine | =3.1 | |
| Cisco Identity Services Engine | =3.1-patch1 | |
| Cisco Identity Services Engine | =3.1-patch3 | |
| Cisco Identity Services Engine | =3.1-patch4 | |
| Cisco Identity Services Engine | =3.1-patch5 | |
| Cisco Identity Services Engine | =3.1-patch6 | |
| Cisco Identity Services Engine | =3.2 | |
| Cisco Identity Services Engine | =3.2-patch1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2023-20167?
The severity of CVE-2023-20167 is medium.
What are the affected software versions of CVE-2023-20167?
The affected software versions of CVE-2023-20167 are Cisco Identity Services Engine 3.1 up to and including 3.1-patch6, and Cisco Identity Services Engine 3.2 up to and including 3.2-patch1.
What can an authenticated attacker do with CVE-2023-20167?
An authenticated attacker can perform path traversal attacks on the underlying operating system to either elevate privileges to root or read arbitrary files.
How can I exploit CVE-2023-20167?
To exploit CVE-2023-20167, you need valid Admin credentials and can then perform the path traversal attacks.
What is the Common Vulnerabilities and Exposures (CVE) ID for this vulnerability?
The Common Vulnerabilities and Exposures (CVE) ID for this vulnerability is CVE-2023-20167.
- collector/nvd-index
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/severity
- agent/author
- agent/weakness
- agent/title
- agent/last-modified-date
- agent/tags
- agent/first-publish-date
- agent/event
- agent/description
- vendor/cisco
- canonical/cisco identity services engine
- version/cisco identity services engine/3.1
- version/cisco identity services engine/3.1-patch1
- version/cisco identity services engine/3.1-patch3
- version/cisco identity services engine/3.1-patch4
- version/cisco identity services engine/3.1-patch5
- version/cisco identity services engine/3.1-patch6
- version/cisco identity services engine/3.2
- version/cisco identity services engine/3.2-patch1