CVE-2024-20486: Cisco Identity Services Engine Cross-Site Request Forgery Vulnerability
A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected device. This vulnerability is due to insufficient CSRF protections for the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to follow a crafted link. A successful exploit could allow the attacker to perform arbitrary actions on the affected device with the privileges of the targeted user.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-20486?
CVE-2024-20486 is rated as a high-severity vulnerability due to its potential to allow unauthenticated remote attackers to perform CSRF attacks.
How does CVE-2024-20486 exploit the Cisco Identity Services Engine?
CVE-2024-20486 exploits the lack of adequate CSRF protection in the web-based management interface of Cisco Identity Services Engine.
What are the potential impacts of CVE-2024-20486?
An attacker exploiting CVE-2024-20486 could perform arbitrary actions on the affected Cisco Identity Services Engine device.
How do I fix CVE-2024-20486?
To fix CVE-2024-20486, apply the latest security patches or updates provided by Cisco for the Identity Services Engine.
Who is affected by CVE-2024-20486?
CVE-2024-20486 affects all versions of Cisco Identity Services Engine that lack proper CSRF protections.