中文描述:

Cisco Identity Services Engine（ISE）是美国思科（Cisco）公司的一款基于身份的环境感知平台（ISE身份服务引擎）。该平台通过收集网络、用户和设备中的实时信息，制定并实施相应策略来监管网络。ISE Express是它的精简版。ISE Virtual Appliance是一款ISE虚拟设备。authentication moudle是其中的一个身份验证模块。 多款Cisco产品中的authentication模块存在身份验证绕过漏洞，该漏洞源于程序没有正确的处理身份验证请求或策略分配。远程攻击者可利用该漏洞获取ISE Admin门户网站的Super Admin权限。以下产品和版本受到影响：Cisco ISE 1.3版本，1.4版本，2.0.0版本，2.0.1版本，2.1.0版本；ISE Express 1.3版本，1.4版本，2.0.0版本，2.0.1版本，2.1.0版本；ISE Virtual Appliance 1.3版本，1.4版本，2.0.0版本，2.0.1版本，2.1.0版本。

英文描述:

A vulnerability in the authentication module of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to bypass local authentication. The vulnerability is due to improper handling of authentication requests and policy assignment for externally authenticated users. An attacker could exploit this vulnerability by authenticating with a valid external user account that matches an internal username and incorrectly receiving the authorization policy of the internal account. An exploit could allow the attacker to have Super Admin privileges for the ISE Admin portal. This vulnerability does not affect endpoints authenticating to the ISE. The vulnerability affects Cisco ISE, Cisco ISE Express, and Cisco ISE Virtual Appliance running Release 1.3, 1.4, 2.0.0, 2.0.1, or 2.1.0. Release 2.2.x is not affected. Cisco Bug IDs: CSCvb10995.

CWE类型:

标签:

中文解决方案:

英文解决方案:

临时解决方案: