Cisco ISE Information Disclosure Vulnerability

An information disclosure vulnerability has been identified in the web-based management interface of Cisco Identity Services Engine (ISE). This vulnerability allows an authenticated, remote attacker with read-only Administrator privileges to access sensitive information from the affected device. The issue arises because certain files do not have adequate data protection, enabling the attacker to view passwords and other information that should be restricted to high-privileged users.

Impact

Exploitation of this vulnerability could result in unauthorized access to sensitive information, such as passwords, that are not normally visible to read-only administrators.

Remediation

Cisco has released software updates to address this vulnerability. Instructions for upgrading can be found on the Cisco Identity Service Engine support page.