CVE-2024-20332: cisco cisco identity services engine software Server-Side Request Forgery (SSRF)

Vulnerability summary

CVE-2024-20332 is a medium (CVSS 5.5) Server-Side Request Forgery (SSRF) vulnerability in cisco cisco identity services engine software. EPSS estimates a 0.37% chance of exploitation in the next 30 days, higher than 29.5% of scored vulnerabilities.

Timeline

1. 03-04-2024
   PublishedVulnerability first disclosed.
2. 26-08-2025
   Last modifiedVulnerability information updated.

Description

A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to conduct a server-side request forgery (SSRF) attack through an affected device. This vulnerability is due to improper input validation for specific HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to send arbitrary network requests that are sourced from the affected device. To successfully exploit this vulnerability, the attacker would need valid Super Admin credentials.

• CWE-918Server-Side Request Forgery (SSRF)The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.