VDB
CVE-2022-20914
CVE-2022-20914
PUBLISHED
CVSS 4.900000095367432 MEDIUM
A vulnerability in the External RESTful Services (ERS) API of Cisco Identity Services Engine (ISE) Software could allow an authenticated, remote attacker to obtain sensitive information. This vulnerability is due to excessive verbosity in a specific REST API output. An attacker could exploit this vulnerability by sending a crafted HTTP request to the affected device. A successful exploit could allow the attacker to obtain sensitive information, including administrative credentials for an external authentication server. Note: To successfully exploit this vulnerability, the attacker must have valid ERS administrative credentials.
EPSS 0.93% · 58.2th percentile
Risk Scores
CVSS 3.1
4.900000095367432
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
EPSS Score
0.93%
58.2th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| cisco | identity_services_engine | 2.7.0, 2.4.0, 2.6.0 |
| Cisco | Cisco Identity Services Engine Software | * |
Timeline
- Aug 10, 2022 CVE Published
- Aug 11, 2022 EPSS Score
- Sep 26, 2022 EPSS Score
- Nov 12, 2022 EPSS Score
- Dec 28, 2022 EPSS Score
- Feb 12, 2023 EPSS Score
- Mar 7, 2023 EPSS Score
- Mar 31, 2023 EPSS Score
- May 16, 2023 EPSS Score
- Aug 17, 2023 EPSS Score
- Oct 2, 2023 EPSS Score
- Nov 17, 2023 EPSS Score