中文描述:

Cisco Identity Services Engine（Cisco ISE）和Cisco ISE Passive Identity Connector都是美国思科（Cisco）公司的产品。Cisco Identity Services Engine是一款环境感知平台（ISE身份服务引擎）。该平台通过收集网络、用户和设备中的实时信息，制定并实施相应策略来监管网络。Cisco ISE Passive Identity Connector是一个身份服务引擎被动身份连接器。 Cisco Identity Services Engine（Cisco ISE）和Cisco ISE Passive Identity Connector存在代码问题漏洞，该漏洞源于基于Web的管理界面解析XML不当，可能导致读取任意文件。

英文描述:

A vulnerability in the licensing features of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow an authenticated, remote attacker with administrative privileges to gain access to sensitive information.  This vulnerability is due to improper parsing of XML that is processed by the web-based management interface of Cisco ISE and Cisco ISE-PIC. An attacker could exploit this vulnerability by uploading a malicious file to the application. A successful exploit could allow the attacker to read arbitrary files from the underlying operating system that could include sensitive data that should otherwise be inaccessible even to administrators. To exploit this vulnerability, the attacker must have valid administrative credentials.

CWE类型:

标签:

中文解决方案:

英文解决方案:

临时解决方案:

发布时间:

修改时间:

创建时间:

更新时间:

当前版本: v3

主要语言: EN

支持语言: