CVE-2022-20733 Cisco Identity Services Engine Authentication Bypass Vulnerability

Medium 5.3 Published 15 Jun 2022 Updated 6 Nov 2024

Unauthenticated remote attackers can bypass login using exposed SAML metadata to gain unrestricted access to all roles in Cisco ISE.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2022-20733?

CVE-2022-20733 is a medium-severity authentication bypass vulnerability in Cisco Identity Services Engine, published on 15 Jun 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A vulnerability in the login page of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to log in without credentials and access all roles without any restrictions. This vulnerability is due to exposed sensitive Security Assertion Markup Language (SAML) metadata. An attacker could exploit this vulnerability by using the exposed SAML metadata to bypass authentication to the user portal. A successful exploit could allow the attacker to access all roles without any restrictions.

Weakness: CWE-287

Which versions are affected by CVE-2022-20733?

It affects 1 product.

Products include Cisco Identity Services Engine.

How do I fix CVE-2022-20733?

No fix has been published for CVE-2022-20733 yet. Limit exposure of the affected software until one is available.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2022-20733 being exploited?

There is no known exploitation of CVE-2022-20733 in the wild and no public exploit code.

All Cisco Identity Services Engine vulnerabilities

Sources

Also known as GHSA-gqhw-x424-g962.