CVE-2024-20527: Cisco Identity Services Engine Arbitrary File Read and Delete Vulnerability
First published: Wed Nov 06 2024(Updated: )
A vulnerability in the API of Cisco ISE could allow an authenticated, remote attacker to read and delete arbitrary files on an affected device. To exploit this vulnerability, the attacker would need valid Super Admin credentials. This vulnerability is due to insufficient validation of user-supplied parameters in API requests. An attacker could exploit this vulnerability by sending a crafted API request to an affected device. A successful exploit could allow the attacker to read or delete arbitrary files on the underlying operating system.
Credit: ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco Identity Services Engine (ISE) |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-20527?
CVE-2024-20527 is classified as a high-severity vulnerability due to its potential impact on file integrity.
How do I fix CVE-2024-20527?
To mitigate CVE-2024-20527, ensure that your Cisco ISE is updated to the latest version provided by Cisco.
What are the prerequisites for exploiting CVE-2024-20527?
An attacker must possess valid Super Admin credentials to exploit CVE-2024-20527.
What type of files can be accessed by exploiting CVE-2024-20527?
CVE-2024-20527 allows attackers to read and delete arbitrary files on the affected device.
Which product is affected by CVE-2024-20527?
CVE-2024-20527 affects Cisco Identity Services Engine.
- agent/references
- agent/title
- agent/weakness
- agent/first-publish-date
- agent/type
- agent/description
- agent/severity
- agent/author
- agent/event
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- collector/mitre-cve
- source/MITRE
- agent/source
- agent/tags
- agent/softwarecombine
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/cisco
- canonical/cisco identity services engine (ise)