A vulnerability in the Identity Services Engine (ISE) integration feature of Cisco Prime Infrastructure (PI) could allow an unauthenticated, remote attacker to perform a man-in-the-middle attack against the Secure Sockets Layer (SSL) tunnel established between ISE and PI. The vulnerability is due to improper validation of the server SSL certificate when establishing the SSL tunnel with ISE. An attacker could exploit this vulnerability by using a crafted SSL certificate and could then intercept communications between the ISE and PI. A successful exploit could allow the attacker to view and alter potentially sensitive information that the ISE maintains about clients that are connected to the network. This vulnerability affects Cisco Prime Infrastructure Software Releases 2.2 through 3.4.0 when the PI server is integrated with ISE, which is disabled by default.
Published 2019-02-21 15:29:00
Updated 2019-10-09 23:47:39
View at NVD,   CVE.org

Products affected by CVE-2019-1659

Exploit prediction scoring system (EPSS) score for CVE-2019-1659

0.14%
Probability of exploitation activity in the next 30 days EPSS Score History
~ 48 %
Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2019-1659

Base Score Base Severity CVSS Vector Exploitability Score Impact Score Score Source First Seen
5.8
MEDIUM AV:N/AC:M/Au:N/C:P/I:P/A:N
8.6
4.9
NIST
7.4
HIGH CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
2.2
5.2
NIST
7.4
HIGH CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
2.2
5.2
Cisco Systems, Inc.

CWE ids for CVE-2019-1659

References for CVE-2019-1659

Jump to
This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!