CVSS: 9.8EPSS: 0%CPEs: 18EXPL: 0CVE-2017-6747
https://notcve.org/view.php?id=CVE-2017-6747
A vulnerability in the authentication module of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to bypass local authentication. The vulnerability is due to improper handling of authentication requests and policy assignment for externally authenticated users. An attacker could exploit this vulnerability by authenticating with a valid external user account that matches an internal username and incorrectly receiving the authorization policy of the internal account. An exploit could allow the attacker to have Super Admin privileges for the ISE Admin portal. This vulnerability does not affect endpoints authenticating to the ISE. • http://www.securitytracker.com/id/1039054 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170802-ise • CWE-287: Improper Authentication •
CVSS: 5.4EPSS: 0%CPEs: 9EXPL: 0CVE-2017-6734
https://notcve.org/view.php?id=CVE-2017-6734
A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) Software could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web interface of an affected device, related to the Guest Portal. More Information: CSCvd74794. Known Affected Releases: 1.3(0.909) 2.1(0.800). Una vulnerabilidad en la interfaz de gestión web del portal de Cisco Identity Services Engine (ISE) Software podría permitir que un atacante remoto autenticado lleve a cabo un ataque de Cross-Site Scripting (XSS) contra un usuario de dicha interfaz en un sistema afectado. Esto se relaciona con Guest Portal. • http://www.securityfocus.com/bid/99459 http://www.securitytracker.com/id/1038823 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170705-ise2 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •