CVE-2018-15440
Cisco Identity Services Engine Multiple Cross-Site Scripting Vulnerabilities
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the web interface of an affected system. The vulnerability is due to insufficient sanitization of user-supplied data that is written to log files and displayed in certain web pages of the web-based management interface of an affected device. An attacker could exploit this vulnerability by convincing a user of the interface to click a specific link or view an affected log file. The injected script code may be executed in the context of the web-based management interface or allow the attacker to access sensitive browser-based information.
Una vulnerabilidad en la interfaz de gestión web de Cisco Identity Services Engine (ISE) podría permitir que un atacante remoto no autenticado lleve a cabo un ataque de Cross-Site Scripting (XSS) persistente contra un usuario de dicha interfaz en un sistema afectado. La vulnerabilidad se debe al saneamiento insuficiente de los datos proporcionados por el usuario que se escriben en archivos de registro y se muestran en ciertas páginas web de la interfaz de gestión web de un dispositivo afectado. Un atacante podría explotar esta vulnerabilidad convenciendo a un usuario de la interfaz para que haga clic en un enlace específico o visualice un archivo de registro afectado. El código script inyectado podría ejecutarse en el contexto de la interfaz web de gestión o permitir que el atacante acceda a información sensible del navegador.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2018-08-17 CVE Reserved
- 2019-01-15 CVE Published
- 2024-06-01 EPSS Updated
- 2024-09-16 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CAPEC
References (2)
URL | Tag | Source |
---|---|---|
http://www.securityfocus.com/bid/106513 | Third Party Advisory |
URL | Date | SRC |
---|
URL | Date | SRC |
---|
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Cisco Search vendor "Cisco" | Identity Services Engine Software Search vendor "Cisco" for product "Identity Services Engine Software" | 2.4\(0.357\) Search vendor "Cisco" for product "Identity Services Engine Software" and version "2.4\(0.357\)" | - |
Affected
|