CVE-2022-20733 — Cisco Identity Services Engine Authentication Bypass Vulnerability

Description (CNA)

A vulnerability in the login page of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to log in without credentials and access all roles without any restrictions. This vulnerability is due to exposed sensitive Security Assertion Markup Language (SAML) metadata. An attacker could exploit this vulnerability by using the exposed SAML metadata to bypass authentication to the user portal. A successful exploit could allow the attacker to access all roles without any restrictions.

Affected (CNA)

Vendor / product	Versions
Cisco / Cisco Identity Services Engine Software	affected n/a

CWE

CWE-287

References

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ISE-SAML-nuukMPf9

ADP enrichment

CVE

No English description supplied.

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ISE-SAML-nuukMPf9

CISA-ADP

No English description supplied.

No references supplied.