CVE-2023-20272: Input Validation
A vulnerability in the web-based management interface of Cisco Identity Services Engine could allow an authenticated, remote attacker to upload malicious files to the web root of the application. This vulnerability is due to insufficient file input validation. An attacker could exploit this vulnerability by uploading a malicious file to the web interface. A successful exploit could allow the attacker to replace files and gain access to sensitive server-side information.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2023-20272?
CVE-2023-20272 is a vulnerability in the web-based management interface of Cisco Identity Services Engine that allows an authenticated, remote attacker to upload malicious files to the web root of the application.
How severe is CVE-2023-20272?
CVE-2023-20272 has a severity rating of 8.8 (high).
What is the affected software version?
The affected software versions are Cisco Identity Services Engine 3.0.0, 3.0.0-patch1, 3.0.0-patch2, 3.0.0-patch3, 3.0.0-patch4, 3.0.0-patch5, 3.0.0-patch6, 3.0.0-patch7, 3.1, 3.1-patch1, 3.1-patch2, 3.1-patch3, and 3.1-patch4.
How can an attacker exploit CVE-2023-20272?
An attacker can exploit CVE-2023-20272 by leveraging insufficient file input validation to upload malicious files to the web root of the application.
Where can I find more information about CVE-2023-20272?
More information about CVE-2023-20272 can be found at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-mult-j-KxpNynR