VDB
CVE-2022-20914
CVE-2022-20914
PUBLISHED
CVSS 4.900000095367432 MEDIUM
A vulnerability in the External RESTful Services (ERS) API of Cisco Identity Services Engine (ISE) Software could allow an authenticated, remote attacker to obtain sensitive information. This vulnerability is due to excessive verbosity in a specific REST API output. An attacker could exploit this vulnerability by sending a crafted HTTP request to the affected device. A successful exploit could allow the attacker to obtain sensitive information, including administrative credentials for an external authentication server. Note: To successfully exploit this vulnerability, the attacker must have valid ERS administrative credentials.
EPSS 0.16% · 36.1th percentile
Risk Scores
CVSS 3.1
4.900000095367432
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
EPSS Score
0.16%
36.1th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| cisco | identity_services_engine | 2.7.0, 2.4.0, 2.6.0 |
| Cisco | Cisco Identity Services Engine Software | * |
Exploit Intelligence
Timeline
- Aug 10, 2022 CVE Published
- Aug 11, 2022 EPSS Score
- Sep 26, 2022 EPSS Score
- Nov 11, 2022 EPSS Score
- Dec 27, 2022 EPSS Score
- Feb 12, 2023 EPSS Score
- Mar 7, 2023 EPSS Score
- Mar 30, 2023 EPSS Score
- May 15, 2023 EPSS Score
- Jun 30, 2023 EPSS Score
- Aug 15, 2023 EPSS Score
- Sep 30, 2023 EPSS Score