漏洞标题
N/A
漏洞描述信息
Cisco身份服务引擎(ISE)某些CLI命令中的漏洞可能导致有认证权限的本地攻击者以本地用户的身份在主机操作系统上执行任意命令，即命令注入。这些命令本应该限制在此用户下执行。该漏洞是由于CLI命令用户输入的输入验证不足。攻击者可以通过向目标设备进行认证并发布由精心构造的用户输入的CLI命令来利用此漏洞。一个成功的漏洞利用可能导致攻击者在受影响的系统上执行应该被限制的任意命令。攻击者需要为设备 valid user credentials。Cisco漏洞 ID: CSCvf49844。
CVSS信息
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H
漏洞类别
N/A
漏洞标题
N/A
漏洞描述信息
A vulnerability in certain CLI commands of Cisco Identity Services Engine (ISE) could allow an authenticated, local attacker to execute arbitrary commands on the host operating system with the privileges of the local user, aka Command Injection. These commands should have been restricted from this user. The vulnerability is due to insufficient input validation of CLI command user input. An attacker could exploit this vulnerability by authenticating to the targeted device and issuing a CLI command with crafted user input. A successful exploit could allow the attacker to execute arbitrary commands on the affected system that should be restricted. The attacker would need to have valid user credentials for the device. Cisco Bug IDs: CSCvf49844.
CVSS信息
N/A
漏洞类别
输入验证不恰当
漏洞标题
Cisco Identity Services Engine 命令注入漏洞
漏洞描述信息
Cisco Identity Services Engine（ISE）是美国思科（Cisco）公司的一款基于身份的环境感知平台（ISE身份服务引擎）。该平台通过收集网络、用户和设备中的实时信息，制定并实施相应策略来监管网络。 Cisco ISE中的CLI命令存在命令注入漏洞，该漏洞源于程序没有充分的验证CLI命令中用户的输入。本地攻击者可通过向受影响设备进行身份验证并发送带有特制的用户输入的CLI命令利用该漏洞在受影响的系统上执行任意命令。
CVSS信息
N/A
漏洞类别
授权问题