CVE-2018-0187
Cisco Identity Services Engine Privileged Account Sensitive Information Disclosure Vulnerability
Published 7 y ago · modified 4 mo ago · JSON
Summary
A vulnerability in the Admin portal of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to obtain confidential information for privileged accounts. The vulnerability is due to the improper handling of confidential information. An attacker could exploit this vulnerability by logging into the web interface on a vulnerable system. An exploit could allow an attacker to obtain confidential information for privileged accounts. This information could then be used to impersonate or negatively impact the privileged account on the affected system.
CISA SSVC assessment
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 23 mo ago
Exploit prediction (EPSS)
1.48% probability of exploitation in the next 30 days, higher than 74% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| CNA | 3.0 | 6.5 | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
| CNA | 3.0 | 6.5 | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
| NVD | 3.0 | 6.5 | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
| NVD | 2.0 | 4.0 | AV:N/AC:L/Au:S/C:P/I:N/A:N |
Affected products
- Cisco Cisco Identity Services Engine Software
Classification
- Weakness
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
References
- tools.cisco.com /security/center/content/CiscoSecurityAdvisory/cisco-sa-20190123-ise-info-disclosure · vendor-advisory, x_refsource_CISCO, x_transferred
- securityfocus.com /bid/106717 · vdb-entry, x_refsource_BID, x_transferred
Sources
- CVE List: CVE-2018-0187
- NVD: CVE-2018-0187
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.