CVE-2021-40123
MEDIUMCisco Identity Services Engine - Authenticated Arbitrary File Download via Web Interface
Title source: llmDescription
A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker with administrative read-only privileges to download files that should be restricted. This vulnerability is due to incorrect permissions settings on an affected device. An attacker could exploit this vulnerability by sending a crafted HTTP request to the device. A successful exploit could allow the attacker to download files that should be restricted.
References (1)
Core 1
Core References
Vendor Advisory vendor-advisory
x_refsource_cisco
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-file-download-B3BR5KQA
Scores
CVSS v3
4.3
EPSS
0.0005
EPSS Percentile
14.9%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
partial
Details
CWE
CWE-266
CWE-276
Status
published
Products (9)
cisco/identity_services_engine
2.6.0 (9 CPE variants)
cisco/identity_services_engine
2.7
cisco/identity_services_engine
2.7\(0.207\)
cisco/identity_services_engine
2.7\(0.356\) (2 CPE variants)
cisco/identity_services_engine
2.7\(0.903\)
cisco/identity_services_engine
2.7.0 (5 CPE variants)
cisco/identity_services_engine
3.0\(0.458\)
cisco/identity_services_engine
3.0.0 (4 CPE variants)
cisco/identity_services_engine
< 2.6
Published
Oct 21, 2021
Tracked Since
Feb 18, 2026