Cisco ISE Stored XSS Vulnerability

CVE-2024-20487

Summary

The web-based management interface of Cisco ISE is affected by a vulnerability that arises from inadequate validation of user-supplied input. This flaw allows an authenticated, remote attacker with a low-privileged account to perform a stored cross-site scripting (XSS) attack. By injecting malicious scripts into certain pages of the management interface, attackers could execute arbitrary code in the context of the affected interface. This exploit may lead to unauthorized access to sensitive browser-based information, posing significant risks to user safety and data integrity.

References