Cross-Site Scripting Vulnerability in Cisco Identity Services Engine
CVE-2018-0339

6.1MEDIUM

Key Information:

Vendor
Cisco
Status
Cisco Identity Services Engine Unknown
Vendor
CVE Published:
7 June 2018

Summary

A vulnerability exists in the web-based management interface of Cisco Identity Services Engine (ISE) that could allow remote attackers to perform cross-site scripting (XSS) attacks. This flaw arises from inadequate validation of user input on certain parameters, potentially enabling attackers to execute arbitrary scripts in the context of the web interface. By enticing users to click on malicious links, attackers may gain access to sensitive browser-based information.

Affected Version(s)

Cisco Identity Services Engine unknown Cisco Identity Services Engine unknown

References

https://tools.cisco.com/security/center/content/CiscoSecu...
x_refsource_CONFIRM
http://www.securityfocus.com/bid/104424
vdb-entryx_refsource_BID
http://www.securitytracker.com/id/1041066
vdb-entryx_refsource_SECTRACK

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.