The periodic-backup feature in Cisco Identity Services Engine (ISE) allows remote attackers to discover backup-encryption passwords via a crafted request that triggers inclusion of a password in a reply, aka Bug ID CSCur41673.
Source: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8017
Reference (s):
- BID:71767
- URL: http://www.securityfocus.com/bid/71767
- CISCO:20141222 Cisco Identity Services Engine Periodic Backup Password Disclosure Vulnerability
- URL: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-8017
- SECTRACK:1031425