This vulnerability exists due to improper authorization enforcement on certain files within the Cisco ISE web management interface. An attacker with administrative and management rights over network users can exploit this flaw by exporting user data, thereby gaining unauthorized access to sensitive information, including passwords that should not be visible to them. The CVSS 3.1 base score is 4.9, reflecting a network attack vector with low complexity but requiring high privileges and no user interaction. The impact is confidentiality loss without affecting integrity or availability.

An attacker with administrative privileges can access sensitive user information beyond their authorized security group, including passwords normally hidden from administrators. This compromises confidentiality of network user data but does not affect system integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, administrators should monitor Cisco advisories for updates. Until a fix is available, restrict administrative access to trusted personnel and audit management actions closely.