CVE-2019-1851 is a medium-severity vulnerability in the External RESTful Services (ERS) API of Cisco Identity Services Engine (ISE). Due to incorrect role-based access control, an authenticated, remote attacker with administrative credentials could generate arbitrary certificates signed by the ISE Internal CA. This allows the attacker to create trusted certificates with arbitrary attributes, potentially enabling access to other certificate-protected networks or assets. While the CVSS score is 6.8, there is no known public exploit code, active exploitation, or significant community discussion surrounding this vulnerability.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
2.2\(0.470\)CPE matchmatch criteria | cpe:2.3:a:cisco:identity_services_engine:2.2\(0.470\):*:*:*:*:*:*:* | ||
2.3\(0.298\)CPE matchmatch criteria | cpe:2.3:a:cisco:identity_services_engine:2.3\(0.298\):*:*:*:*:*:*:* | ||
2.4\(0.357\)CPE matchmatch criteria | cpe:2.3:a:cisco:identity_services_engine:2.4\(0.357\):*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.