Blind SQL Injection Vulnerabilities in Cisco ISE REST API

CVE-2024-20417

Summary

Multiple vulnerabilities have been identified in the REST API of Cisco Identity Services Engine (ISE), enabling potential blind SQL injection attacks by authenticated, remote attackers. These vulnerabilities arise from inadequate validation of user-supplied input within API calls. An attacker could exploit these weaknesses by sending specially crafted input to the system. Successful exploitation may allow unauthorized access to view or modify sensitive data stored on the affected device.

References