VulnerabilityModified

CVE-2013-5538

The Sponsor Portal in Cisco Identity Services Engine (ISE) uses weak permissions for uploaded files, which allows remote attackers to read arbitrary files via a direct request, aka Bug ID CSCui67506.

MEDIUM 5.0EPSS 1.19%

Does this matter?

Lower severity and a low EPSS score (1.19%). Track it; it rarely justifies an emergency change on its own.

Description

The Sponsor Portal in Cisco Identity Services Engine (ISE) uses weak permissions for uploaded files, which allows remote attackers to read arbitrary files via a direct request, aka Bug ID CSCui67506.

CVSS 2.0: 5.0 MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
EPSS: 1.19% probability · 66th percentile
CISA KEV: Not listed
Weakness: CWE-264
Affected: cisco/identity services engine software · cisco/identity services engine
Source: psirt@cisco.com

References

http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-5538Vendor Advisory
http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-5538Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.