CVE-2022-20782— Cisco Identity Services Engine Sensitive Information Disclosure Vulnerability
Quick assessment
Affected
Cisco Cisco Identity Services Engine Software
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Cisco Identity Services Engine（ISE）是美国思科（Cisco）公司的一款环境感知平台（ISE身份服务引擎）。该平台通过收集网络、用户和设备中的实时信息，制定并实施相应策略来监管网络。 Cisco Identity Services Engine（ISE）存在安全漏洞，该漏洞源于对敏感数据的管理权限级别执行不当造成的。远程攻击者利用该漏洞能够从受影响的设备获取敏感信息。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2022-20782
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Cisco Identity Services Engine Sensitive Information Disclosure Vulnerability
Source: CVE Program / CVE List V5
Vulnerability Description
A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to obtain sensitive information from an affected device. This vulnerability is due to improper enforcement of administrative privilege levels for high-value sensitive data. An attacker with read-only Administrator privileges to the web-based management interface on an affected device could exploit this vulnerability by browsing to a page that contains sensitive data. A successful exploit could allow the attacker to collect sensitive information regarding the configuration of the system.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
特权授予不正确
Source: CVE Program / CVE List V5
Vulnerability Title
Cisco Identity Services Engine 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Cisco Identity Services Engine（ISE）是美国思科（Cisco）公司的一款环境感知平台（ISE身份服务引擎）。该平台通过收集网络、用户和设备中的实时信息，制定并实施相应策略来监管网络。 Cisco Identity Services Engine（ISE）存在安全漏洞，该漏洞源于对敏感数据的管理权限级别执行不当造成的。远程攻击者利用该漏洞能够从受影响的设备获取敏感信息。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Cisco | Cisco Identity Services Engine Software | n/a | - |
|
II. Public POCs for CVE-2022-20782
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2022-20782
请登录查看更多情报信息。
Vendor Advisories for CVE-2022-20782 (1)
-
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-info-exp-YXAWYP3s vendor-advisory x_refsource_CISCO
Same Patch Batch · Cisco · 2022-04-06 · 12 CVEs total
| CVE-2022-20755 | 9.0 CRITICAL | Cisco Expressway Series and Cisco TelePresence Video Communication Server Vulnerabilities |
| CVE-2022-20754 | 9.0 CRITICAL | Cisco Expressway Series and Cisco TelePresence Video Communication Server Vulnerabilities |
| CVE-2022-20756 | 8.6 HIGH | Cisco Identity Services Engine RADIUS Service Denial of Service Vulnerability |
| CVE-2022-20762 | 7.8 HIGH | Cisco Ultra Cloud Core - Subscriber Microservices Infrastructure Privilege Escalation Vuln |
| CVE-2022-20774 | 6.8 MEDIUM | Cisco IP Phone 6800, 7800, and 8800 Series with Multiplatform Firmware Cross-Site Request |
| CVE-2022-20665 | 6.0 MEDIUM | Cisco StarOS Command Injection Vulnerability |
| CVE-2022-20784 | 5.8 MEDIUM | Cisco Web Security Appliance Filter Bypass Vulnerability |
| CVE-2022-20741 | 5.4 MEDIUM | Cisco Secure Network Analytics Network Diagrams Application Cross-Site Scripting Vulnerabi |
| CVE-2022-20763 | 5.4 MEDIUM | Cisco Webex Meetings Java Deserialization Vulnerability |
| CVE-2022-20781 | 5.4 MEDIUM | Cisco Web Security Appliance Stored Cross-Site Scripting Vulnerability |
| CVE-2022-20675 | 5.3 MEDIUM | Multiple Cisco Security Products Simple Network Management Protocol Service Denial of Serv |
IV. Related Vulnerabilities
Same product: Cisco Identity Services Engine Software
-
CVE-2026-76426
Cisco ISE REST API SQL Injection Vulnerability -
CVE-2026-76431
Cisco Identity Services Engine Arbitrary File Deletion Vulne -
CVE-2026-76427
Cisco ISE XML External Entity Injection Vulnerability -
CVE-2026-76447
Cisco Identity Services Engine Certificate Reload Vulnerabil -
CVE-2026-20287
Cisco Identity Services Engine Hardening Release - Improper
Same vendor: Cisco
-
CVE-2026-76472
Cisco Meraki Security Hardening Release October 2026 - Impro -
CVE-2026-76467
Cisco Meraki Software Hardening Release - Resource Lifetime -
CVE-2026-76470
Cisco Meraki Hardening Release - Incorrect Calculation Vulne -
CVE-2026-76469
Cisco Meraki Security Hardening Release: October 2026 Insuff -
CVE-2026-76468
Cisco Meraki Hardening Release - Input Validation Vulnerabil
Same weakness: CWE-266
-
CVE-2026-96539
WordPress Ultimate Member plugin <= 2.13.1 - Privilege Escal -
CVE-2026-106145
Privilege Escalation in Telerik Report Server Service-Agent -
CVE-2026-105070
WordPress Salon booking system plugin <= 10.31.7 - Privilege -
CVE-2026-105058
WordPress WP User Profiles plugin <= 2.7.3 - Privilege Escal -
CVE-2026-104757
WordPress Import and export users and customers plugin <= 2.
V. Comments for CVE-2022-20782
No comments yet