CVE-2022-20965: cisco cisco identity services engine software Incorrect Use of Privileged APIs

Vulnerability summary

CVE-2022-20965 is a medium (CVSS 5.4) Incorrect Use of Privileged APIs vulnerability in cisco cisco identity services engine software. EPSS estimates a 0.61% chance of exploitation in the next 30 days, higher than 48% of scored vulnerabilities.

Timeline

1. 18-01-2023
   PublishedVulnerability first disclosed.
2. 03-08-2024
   Last modifiedVulnerability information updated.

Description

A vulnerability in the web-based management interface of Cisco Identity Services Engine could allow an authenticated, remote attacker to take privileges actions within the web-based management interface. This vulnerability is due to improper access control on a feature within the web-based management interface of the affected system. An attacker could exploit this vulnerability by accessing features through direct requests, bypassing checks within the application. A successful exploit could allow the attacker to take privileged actions within the web-based management interface that should be otherwise restricted. {{value}} ["%7b%7bvalue%7d%7d"])}]]

• CWE-648Incorrect Use of Privileged APIsThe product does not conform to the API requirements for a function call that requires extra privileges. This could allow attackers to gain privileges by causing the function to be called incorrectly.