Auth bypass in Cisco Identity_services_engine_software
CVE-2015-6266
The guest portal in Cisco Identity Services Engine (ISE) 3300 1.2(0.899) does not restrict access to uploaded HTML documents, which allows remote attackers to obtain sensitive information from customized documents via a direct request, aka…
Vulnerability class: Broken Authentication
EPSS: 0.002 (45.9th percentile) — read the EPSS interpretation.
Affected products
- Cisco Identity_services_engine_software — versions 1.2\(0.899\)
- N/a — versions n/a
Weakness classification (CWE)
References
- 20150827 Cisco Identity Services Engine Guest Portal Unauthorized Access Vulnerability (x_refsource_CISCO, vendor-advisory, Vendor Advisory)
- 1033405 (vdb-entry, x_refsource_SECTRACK)