| code | #TRUSTED 23211e3637f16cf02003c0556841abea3290883b08c6ba013c6388df0c4f1bf3bf6c68771aaa5e7bc8523dd170c08991418cfa9b7847ee05e77353f8e710e6d42fa783dfccd836bc3c773edce3722b88d7a4beeb23220337682967cfaf52812777b4ca5681029ba22963c1a8a6328db61c0305504760df62a1cc40248ff3cfb6835ffc6aaf2151afcc8f3b8abf7879d61e0eabbd349c5f75a8d30488eb3d12788df1999c3db6b51760487c527d0741b6d5e2d806a66a0c6c8d71e7d9296dadb12fdac04ef9bc3bed012ffd6ccfbad46b74813a66a66d5e11f5e13b7b4edf48cb1703226fee9f82305949e436bb5ef01928afd1a2ee512e693bb394c2762d3fb5edd49198ffee3cbc0dc2d0b2b66d3a2dcbf07553ada3525d168cd4dd1aa02e77d14e54c9f017b46c0ce1d2b52f7840cf436aaf22e57d9df0b4e4f67031192e142350ac8226f7c4766ab7734a5150d8cba2a390fc13335bb5cacff723cb5a4148602fee65aa552058d98da307dbbec7c93c6095e394c5d701e143e727e9662e8fa137fc26352a2194a8ba386620f68156716d07c847f7b739829341e5803a6268d9c37f690c1bd38d9241c560d4043ef418c8fd0e24da88ac995aa316a3c1464f815453ce558129e92f0a3c756704b11d38cb1563325eff310f2a963c0d4b65efd3d7cd3f3ac0b222d66c7b9acb4491faba2080bb2837edccf47dd22df344c74a
#
# (C) Tenable Network Security, Inc.
#
include('compat.inc');
if (description)
{
script_id(133864);
script_version("1.4");
script_set_attribute(attribute:"plugin_modification_date", value:"2020/02/25");
script_cve_id("CVE-2019-15255");
script_xref(name:"CISCO-BUG-ID", value:"CSCvq67348");
script_xref(name:"CISCO-SA", value:"cisco-sa-20200108-ise-auth-bypass");
script_xref(name:"IAVA", value:"2019-A-0361");
script_name(english:"Cisco Identity Services Engine Authorization Bypass (cisco-sa-20200108-ise-auth-bypass)");
script_set_attribute(attribute:"synopsis", value:
"The remote device is missing a vendor-supplied security patch.");
script_set_attribute(attribute:"description", value:
"An authentication bypass vulnerability exists in the web-based
management component of Cisco Identity Services Engine due to
insufficient validation of user-supplied URL input. An authenticated,
remote attacker can exploit this, by submitting specially crafted URL
to an affected host, to bypass authentication and gain access to
sensitive information.");
# https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200108-ise-auth-bypass
script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?c44d3d67");
script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvq67348");
script_set_attribute(attribute:"solution", value:
"Upgrade to the relevant fixed version referenced in Cisco bug ID
CSCvq67348.");
script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:P/I:N/A:N");
script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N");
script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
script_set_attribute(attribute:"cvss_score_source", value:"CVE-2019-15255");
script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
script_set_attribute(attribute:"vuln_publication_date", value:"2020/01/26");
script_set_attribute(attribute:"patch_publication_date", value:"2020/01/26");
script_set_attribute(attribute:"plugin_publication_date", value:"2020/02/24");
script_set_attribute(attribute:"plugin_type", value:"local");
script_set_attribute(attribute:"cpe", value:"cpe:/o:cpe:/a:cisco:identity_services_engine");
script_set_attribute(attribute:"stig_severity", value:"I");
script_end_attributes();
script_category(ACT_GATHER_INFO);
script_family(english:"CISCO");
script_copyright(english:"This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
script_dependencies("cisco_ise_detect.nbin");
script_require_keys("Host/Cisco/ISE/version");
exit(0);
}
include('audit.inc');
include('cisco_workarounds.inc');
include('ccf.inc');
product_info = cisco::get_product_info(name:'Cisco Identity Services Engine Software');
vuln_ranges = [
{ 'min_ver':'2.2.0', 'fix_ver':'2.2.0' }
];
workarounds = make_list(CISCO_WORKAROUNDS['no_workaround']);
workaround_params = make_list();
# ISE version doesn't change when patches are installed, so even if
# they are on the proper version we have to double check patch level
required_patch = '';
if (product_info['version'] =~ "^2\.2\.0($|[^0-9])") required_patch = '16';
reporting = make_array(
'port' , 0,
'severity' , SECURITY_WARNING,
'version' , product_info['version'],
'bug_id' , 'CSCvq67348',
'fix' , 'See advisory'
);
# uses required_patch parameters set by above version ranges
cisco::check_and_report(
product_info: product_info,
reporting: reporting,
workarounds: workarounds,
workaround_params: workaround_params,
vuln_ranges: vuln_ranges,
required_patch: required_patch
);
|