CVE-2014-0681
published 2014-01-29CVE-2014-0681: Cross-site scripting (XSS) vulnerability in Cisco Identity Services Engine (ISE) 1.2 patch 2 and earlier allows remote attackers to inject arbitrary web script…
PriorityP419medium4.3CVSS 2.0
AVNACMAuNCNIPAN
EPSS
1.43%
69.9th percentile
Cross-site scripting (XSS) vulnerability in Cisco Identity Services Engine (ISE) 1.2 patch 2 and earlier allows remote attackers to inject arbitrary web script or HTML via a report containing a crafted URL that is not properly handled during generation of report-output pages, aka Bug ID CSCui15064.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | identity_services_engine_software | <= 1.2 | — |
CVSS provenance
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
vendor_cisco4.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Cisco
Cisco Identity Services Engine Reports Output Cross-Site Scripting Vulnerability
vendor_cisco·2014-01-28·CVSS 4.3
CVE-2014-0681 [MEDIUM] CWE-79 Cisco Identity Services Engine Reports Output Cross-Site Scripting Vulnerability
Cisco Identity Services Engine Reports Output Cross-Site Scripting Vulnerability
A vulnerability in certain report output pages of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against the report pages of Cisco ISE.
The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by injecting a malicious link into a report. An exploit could allow the attacker to cause a user viewing a specific report to execute a malicious script.
Cisco has confirmed the vulnerability in a security notice and released software updates.
To exploit the vulnerability, the attacker may provide a link that directs a user to a malicious site and use misleading language or instruction
GHSA
GHSA-63m8-53q2-389q: Cross-site scripting (XSS) vulnerability in Cisco Identity Services Engine (ISE) 1
ghsa_unreviewed·2022-05-14
CVE-2014-0681 [MEDIUM] CWE-79 GHSA-63m8-53q2-389q: Cross-site scripting (XSS) vulnerability in Cisco Identity Services Engine (ISE) 1
Cross-site scripting (XSS) vulnerability in Cisco Identity Services Engine (ISE) 1.2 patch 2 and earlier allows remote attackers to inject arbitrary web script or HTML via a report containing a crafted URL that is not properly handled during generation of report-output pages, aka Bug ID CSCui15064.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://osvdb.org/102589http://secunia.com/advisories/56714http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0681http://tools.cisco.com/security/center/viewAlert.x?alertId=32609http://www.securityfocus.com/bid/65183http://www.securitytracker.com/id/1029699http://osvdb.org/102589http://secunia.com/advisories/56714http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0681http://tools.cisco.com/security/center/viewAlert.x?alertId=32609http://www.securityfocus.com/bid/65183http://www.securitytracker.com/id/1029699
2014-01-29
Published