CVE-2022-20733

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability in the login page of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to log in without credentials and access all roles without any restrictions. This vulnerability is due to exposed sensitive Security Assertion Markup Language (SAML) metadata. An attacker could exploit this vulnerability by using the exposed SAML metadata to bypass authentication to the user portal. A successful exploit could allow the attacker to access all roles without any restrictions.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-287

Affected software

No affected versions have been published.

Timeline

Published: Jun 15, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-207344.4A vulnerability in Cisco SD-WAN vManage Software could allow an authenticated, local attacker to view sensitive information on an affected s CVE-2022-207356.5A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to co CVE-2022-207365.3A vulnerability in the web-based management interface of Cisco AppDynamics Controller Software could allow an unauthenticated, remote attack CVE-2022-207377.1A vulnerability in the handler for HTTP authentication for resources accessed through the Clientless SSL VPN portal of Cisco Adaptive Securi CVE-2022-207389.8A vulnerability in the Cisco Umbrella Secure Web Gateway service could allow an unauthenticated, remote attacker to bypass the file inspecti CVE-2022-207397.3A vulnerability in the CLI of Cisco SD-WAN vManage Software could allow an authenticated, local attacker to execute arbitrary commands on th CVE-2022-20747.5In affected versions of Octopus Deploy it is possible to perform a Regex Denial of Service using the Variable Project Template.CVE-2022-207406.1A vulnerability in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an unauthenticated, re CVE-2022-207415.4A vulnerability in the web-based management interface of the Network Diagrams application for Cisco Secure Network Analytics, formerly Steal CVE-2022-207427.4A vulnerability in an IPsec VPN library of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Softwar CVE-2022-207438.8A vulnerability in the web management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote att CVE-2022-207446.5A vulnerability in the input protection mechanisms of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote