CVE-2015-4266

The web interface in Cisco Identity Services Engine (ISE) 1.1(4.1), 1.3(106.146), and 1.3(120.135) does not properly restrict use of IFRAME elements, which makes it easier for remote attackers to conduct clickjacking attacks and unspecified other attacks via a crafted web site, related to a "cross-frame scripting (XFS)" issue, aka Bug ID CSCut04556.

CVSS v2.0 4.3 MEDIUM

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://tools.cisco.com/security/center/viewAlert.x?alertId=39871	Vendor Advisory
http://www.securitytracker.com/id/1032930
http://tools.cisco.com/security/center/viewAlert.x?alertId=39871	Vendor Advisory
http://www.securitytracker.com/id/1032930

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:cisco:identity_services_engine_software:1.1\(4.1\):::::::*
	cpe:2.3:a:cisco:identity_services_engine_software:1.3\(106.146\):::::::*
	cpe:2.3:a:cisco:identity_services_engine_software:1.3\(120.135\):::::::*

History

21 Nov 2024, 02:30

Type	Values Removed	Values Added
References	~~() http://tools.cisco.com/security/center/viewAlert.x?alertId=39871 - Vendor Advisory~~	() http://tools.cisco.com/security/center/viewAlert.x?alertId=39871 - Vendor Advisory
References	~~() http://www.securitytracker.com/id/1032930 -~~	() http://www.securitytracker.com/id/1032930 -

Information

Published : 2015-07-16 19:59

Updated : 2024-11-21 02:30

NVD link : CVE-2015-4266

Mitre link : CVE-2015-4266

CVE.ORG link : CVE-2015-4266

JSON object : View

Products Affected

cisco

identity_services_engine_software

CWE

CWE-20

Improper Input Validation

{"id": "CVE-2015-4266", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}]}, "published": "2015-07-16T19:59:00.083", "references": [{"url": "http://tools.cisco.com/security/center/viewAlert.x?alertId=39871", "tags": ["Vendor Advisory"], "source": "ykramarz@cisco.com"}, {"url": "http://www.securitytracker.com/id/1032930", "source": "ykramarz@cisco.com"}, {"url": "http://tools.cisco.com/security/center/viewAlert.x?alertId=39871", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securitytracker.com/id/1032930", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "The web interface in Cisco Identity Services Engine (ISE) 1.1(4.1), 1.3(106.146), and 1.3(120.135) does not properly restrict use of IFRAME elements, which makes it easier for remote attackers to conduct clickjacking attacks and unspecified other attacks via a crafted web site, related to a \"cross-frame scripting (XFS)\" issue, aka Bug ID CSCut04556."}, {"lang": "es", "value": "La interfaz web en Cisco Identity Services Engine (ISE) 1.1 (4.1), 1.3 (106.146) y 1.3 (120.135) no restringe correctamente el uso de elementos IFRAME, lo que facilita a atacantes remotos llevar a cabo ataques de clickjacking y otros ataques no especificados a trav\u00e9s de una p\u00e1gina web manipulada, relacionados con una cuesti\u00f3n de 'cross-frame scripting (XFS)', tambi\u00e9n conocido como Bug ID CSCut04556."}], "lastModified": "2024-11-21T02:30:44.013", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cisco:identity_services_engine_software:1.1\\(4.1\\):*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EF1582C1-CBB5-4041-969C-7896DE00B31B"}, {"criteria": "cpe:2.3:a:cisco:identity_services_engine_software:1.3\\(106.146\\):*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "00932EDA-FF42-4422-893B-654DD3460230"}, {"criteria": "cpe:2.3:a:cisco:identity_services_engine_software:1.3\\(120.135\\):*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DA183646-B28E-4565-A0C2-C8B1591F0569"}], "operator": "OR"}]}], "sourceIdentifier": "ykramarz@cisco.com"}