Server-Side Request Forgery Vulnerability in Cisco Identity Services Engine

CVE-2024-20332

Summary

A vulnerability exists in the web-based management interface of Cisco Identity Services Engine (ISE) that enables an authenticated remote attacker to perform a server-side request forgery (SSRF) attack. This issue arises from improper input validation of specific HTTP requests. An attacker can exploit this vulnerability by sending a maliciously crafted HTTP request to an affected device. If successfully exploited, this vulnerability could allow the attacker to send arbitrary network requests originating from the affected device itself. It is important to note that the attacker must possess valid Super Admin credentials to execute this attack.

References