CVE-2023-20208 — Improper Neutralization of Alternate XSS Syntax in Cisco Identity Services Engine Software

CWE-87 — Improper Neutralization of Alternate XSS Syntax CWE-79 — Cross-site Scripting CWE-424 — Improper Protection of Alternate Path4 documents4 sources

Severity

4.8MEDIUMNVD

EPSS

0.0%

top 85.71%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Cisco Identity Services Engine Software Cisco Identity Services Engine

Timeline

PublishedNov 21

Description

A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to conduct an XSS attack against a user of the web-based management interface of an affected device.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:NExploitability: 1.7 | Impact: 2.7

Affected Packages2 packages

▶NVDcisco/identity_services_engine3.0.0, 3.1, 3.2+2

▶CVEListV5cisco/cisco_identity_services_engine_software13 versions+12

🔴Vulnerability Details

GHSA

GHSA-2ggx-v668-h3cf: A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to conduct an XSS attack against a us↗2023-11-21

▶

CVEList

CVE-2023-20208: A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to conduct an XSS attack against a us↗2023-11-21

▶

📋Vendor Advisories

Cisco

Cisco Identity Services Engine Vulnerabilities↗2023-11-15

▶