Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2017-6747

A vulnerability in the authentication module of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to bypass local authentication. The vulnerability is due to improper handling of authentication requests and policy assignment for externally authenticated users. An attacker could exploit this vulnerability by authenticating with a valid external user account that matches an internal username and incorrectly receiving the authorization policy of the internal account. An exploit could allow the attacker to have Super Admin privileges for the ISE Admin portal. This vulnerability does not affect endpoints authenticating to the ISE. The vulnerability affects Cisco ISE, Cisco ISE Express, and Cisco ISE Virtual Appliance running Release 1.3, 1.4, 2.0.0, 2.0.1, or 2.1.0. Release 2.2.x is not affected. Cisco Bug IDs: CSCvb10995.

Published

2017-08-07T06:29:00.357

Last Modified

2025-04-20T01:37:25.860

Status

Deferred

Source

[email protected]

Severity

CVSSv3.0: 9.8 (CRITICAL)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: NONE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: PARTIAL
  • Availability Impact: PARTIAL
Exploitability Score

10.0

Impact Score

6.4

Weaknesses
  • Type: Secondary
    CWE-287
  • Type: Primary
    CWE-287
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application cisco identity_services_engine 1.3\(0.722\) Yes
Application cisco identity_services_engine 1.3\(0.876\) Yes
Application cisco identity_services_engine 1.3\(0.909\) Yes
Application cisco identity_services_engine 1.3\(106.146\) Yes
Application cisco identity_services_engine 1.3\(120.135\) Yes
Application cisco identity_services_engine 1.4\(0.109\) Yes
Application cisco identity_services_engine 1.4\(0.181\) Yes
Application cisco identity_services_engine 1.4\(0.253\) Yes
Application cisco identity_services_engine 1.4\(0.908\) Yes
Application cisco identity_services_engine 2.0\(0.147\) Yes
Application cisco identity_services_engine 2.0\(0.169\) Yes
Application cisco identity_services_engine 2.0\(0.222\) Yes
Application cisco identity_services_engine 2.0\(1.130\) Yes
Application cisco identity_services_engine 2.0_base Yes
Application cisco identity_services_engine 2.1\(0.474\) Yes
Application cisco identity_services_engine 2.1\(0.800\) Yes
Application cisco identity_services_engine 2.1\(102.101\) Yes
Application cisco identity_services_engine 2.1_base Yes
References