var-201401-0329
Vulnerability from variot

The RBAC implementation in Cisco Identity Services Engine (ISE) Software does not properly verify privileges for support-bundle downloads, which allows remote authenticated users to obtain sensitive information via a download action, as demonstrated by obtaining read access to the user database, aka Bug ID CSCul83904. An attacker can exploit this issue to gain unauthorized access and obtain sensitive information. This may aid in further attacks. This issue is being tracked by Cisco Bug ID CSCul83904. Cisco Identity Services Engine (ISE) is an identity-based context-aware platform (ISE Identity Services Engine) from Cisco. The platform monitors the network by collecting real-time information on the network, users and devices, and formulating and implementing corresponding policies. A permissions and access control vulnerability exists in Cisco ISE Software's role-based access control code

Show details on source website

To clipboard 

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-201401-0329",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "identity services engine software",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "cisco",
        "version": null
      },
      {
        "model": "identity services engine",
        "scope": null,
        "trust": 0.8,
        "vendor": "cisco",
        "version": null
      },
      {
        "model": "identity services engine software",
        "scope": "lte",
        "trust": 0.8,
        "vendor": "cisco",
        "version": "1.2 patch 2"
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-001069"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201401-326"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-0665"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "cpe_match": [
              {
                "cpe22Uri": "cpe:/h:cisco:identity_services_engine",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/a:cisco:identity_services_engine_software",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-001069"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Cisco",
    "sources": [
      {
        "db": "BID",
        "id": "64939"
      }
    ],
    "trust": 0.3
  },
  "cve": "CVE-2014-0665",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "author": "nvd@nist.gov",
            "availabilityImpact": "NONE",
            "baseScore": 4.0,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 8.0,
            "id": "CVE-2014-0665",
            "impactScore": 2.9,
            "integrityImpact": "NONE",
            "severity": "MEDIUM",
            "trust": 1.9,
            "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
            "version": "2.0"
          },
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "author": "VULHUB",
            "availabilityImpact": "NONE",
            "baseScore": 4.0,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 8.0,
            "id": "VHN-68158",
            "impactScore": 2.9,
            "integrityImpact": "NONE",
            "severity": "MEDIUM",
            "trust": 0.1,
            "vectorString": "AV:N/AC:L/AU:S/C:P/I:N/A:N",
            "version": "2.0"
          }
        ],
        "cvssV3": [],
        "severity": [
          {
            "author": "nvd@nist.gov",
            "id": "CVE-2014-0665",
            "trust": 1.0,
            "value": "MEDIUM"
          },
          {
            "author": "NVD",
            "id": "CVE-2014-0665",
            "trust": 0.8,
            "value": "Medium"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-201401-326",
            "trust": 0.6,
            "value": "MEDIUM"
          },
          {
            "author": "VULHUB",
            "id": "VHN-68158",
            "trust": 0.1,
            "value": "MEDIUM"
          },
          {
            "author": "VULMON",
            "id": "CVE-2014-0665",
            "trust": 0.1,
            "value": "MEDIUM"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-68158"
      },
      {
        "db": "VULMON",
        "id": "CVE-2014-0665"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-001069"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201401-326"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-0665"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "The RBAC implementation in Cisco Identity Services Engine (ISE) Software does not properly verify privileges for support-bundle downloads, which allows remote authenticated users to obtain sensitive information via a download action, as demonstrated by obtaining read access to the user database, aka Bug ID CSCul83904. \nAn attacker can exploit this issue to gain unauthorized access and obtain sensitive information. This may aid in further attacks. \nThis issue is being tracked by Cisco Bug ID CSCul83904. Cisco Identity Services Engine (ISE) is an identity-based context-aware platform (ISE Identity Services Engine) from Cisco. The platform monitors the network by collecting real-time information on the network, users and devices, and formulating and implementing corresponding policies. A permissions and access control vulnerability exists in Cisco ISE Software\u0027s role-based access control code",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2014-0665"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-001069"
      },
      {
        "db": "BID",
        "id": "64939"
      },
      {
        "db": "VULHUB",
        "id": "VHN-68158"
      },
      {
        "db": "VULMON",
        "id": "CVE-2014-0665"
      }
    ],
    "trust": 2.07
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2014-0665",
        "trust": 2.9
      },
      {
        "db": "BID",
        "id": "64939",
        "trust": 1.5
      },
      {
        "db": "SECUNIA",
        "id": "56439",
        "trust": 1.2
      },
      {
        "db": "OSVDB",
        "id": "102118",
        "trust": 1.2
      },
      {
        "db": "SECTRACK",
        "id": "1029624",
        "trust": 1.2
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-001069",
        "trust": 0.8
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201401-326",
        "trust": 0.7
      },
      {
        "db": "CISCO",
        "id": "20140115 CISCO ISE UNPRIVILEGED SUPPORT BUNDLE DOWNLOAD VULNERABILITY",
        "trust": 0.6
      },
      {
        "db": "VULHUB",
        "id": "VHN-68158",
        "trust": 0.1
      },
      {
        "db": "VULMON",
        "id": "CVE-2014-0665",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-68158"
      },
      {
        "db": "VULMON",
        "id": "CVE-2014-0665"
      },
      {
        "db": "BID",
        "id": "64939"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-001069"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201401-326"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-0665"
      }
    ]
  },
  "id": "VAR-201401-0329",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-68158"
      }
    ],
    "trust": 0.01
  },
  "last_update_date": "2024-11-23T22:35:17.223000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "Cisco ISE Unprivileged Support Bundle Download Vulnerability",
        "trust": 0.8,
        "url": "http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0665"
      },
      {
        "title": "32448",
        "trust": 0.8,
        "url": "http://tools.cisco.com/security/center/viewAlert.x?alertId=32448"
      },
      {
        "title": "Cisco: Cisco ISE Unprivileged Support Bundle Download Vulnerability",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=cisco_security_advisories_and_alerts_ciscoproducts\u0026qid=Cisco-SA-20140115-CVE-2014-0665"
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2014-0665"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-001069"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-264",
        "trust": 1.9
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-68158"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-001069"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-0665"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 1.8,
        "url": "http://tools.cisco.com/security/center/content/ciscosecuritynotice/cve-2014-0665"
      },
      {
        "trust": 1.3,
        "url": "http://www.securityfocus.com/bid/64939"
      },
      {
        "trust": 1.2,
        "url": "http://tools.cisco.com/security/center/viewalert.x?alertid=32448"
      },
      {
        "trust": 1.2,
        "url": "http://osvdb.org/102118"
      },
      {
        "trust": 1.2,
        "url": "http://www.securitytracker.com/id/1029624"
      },
      {
        "trust": 1.2,
        "url": "http://secunia.com/advisories/56439"
      },
      {
        "trust": 1.2,
        "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/90463"
      },
      {
        "trust": 0.8,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-0665"
      },
      {
        "trust": 0.8,
        "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2014-0665"
      },
      {
        "trust": 0.3,
        "url": "http://www.cisco.com"
      },
      {
        "trust": 0.1,
        "url": "https://cwe.mitre.org/data/definitions/264.html"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov"
      },
      {
        "trust": 0.1,
        "url": "http://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20140115-cve-2014-0665"
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-68158"
      },
      {
        "db": "VULMON",
        "id": "CVE-2014-0665"
      },
      {
        "db": "BID",
        "id": "64939"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-001069"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201401-326"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-0665"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "VULHUB",
        "id": "VHN-68158"
      },
      {
        "db": "VULMON",
        "id": "CVE-2014-0665"
      },
      {
        "db": "BID",
        "id": "64939"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-001069"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201401-326"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-0665"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2014-01-15T00:00:00",
        "db": "VULHUB",
        "id": "VHN-68158"
      },
      {
        "date": "2014-01-15T00:00:00",
        "db": "VULMON",
        "id": "CVE-2014-0665"
      },
      {
        "date": "2014-01-15T00:00:00",
        "db": "BID",
        "id": "64939"
      },
      {
        "date": "2014-01-16T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2014-001069"
      },
      {
        "date": "2014-01-18T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201401-326"
      },
      {
        "date": "2014-01-15T16:11:08.457000",
        "db": "NVD",
        "id": "CVE-2014-0665"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2017-08-29T00:00:00",
        "db": "VULHUB",
        "id": "VHN-68158"
      },
      {
        "date": "2017-08-29T00:00:00",
        "db": "VULMON",
        "id": "CVE-2014-0665"
      },
      {
        "date": "2014-01-15T00:00:00",
        "db": "BID",
        "id": "64939"
      },
      {
        "date": "2014-01-16T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2014-001069"
      },
      {
        "date": "2014-01-18T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201401-326"
      },
      {
        "date": "2024-11-21T02:02:37.190000",
        "db": "NVD",
        "id": "CVE-2014-0665"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201401-326"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Cisco Identity Services Engine Software of  RBAC Vulnerability in which important information is obtained in the implementation of",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-001069"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "permissions and access control",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201401-326"
      }
    ],
    "trust": 0.6
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.