CVE-2018-15455

{"id": "CVE-2018-15455", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.0", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "ykramarz@cisco.com", "cvssData": {"scope": "CHANGED", "version": "3.0", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "published": "2019-01-23T22:29:00.400", "references": [{"url": "http://www.securityfocus.com/bid/106708", "tags": ["Third Party Advisory"], "source": "ykramarz@cisco.com"}, {"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190123-isel-xss", "tags": ["Vendor Advisory"], "source": "ykramarz@cisco.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}, {"type": "Secondary", "source": "ykramarz@cisco.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability in the logging component of Cisco Identity Services Engine could allow an unauthenticated, remote attacker to conduct cross-site scripting attacks. The vulnerability is due to the improper validation of requests stored in the system's logging database. An attacker could exploit this vulnerability by sending malicious requests to the targeted system. An exploit could allow the attacker to conduct cross-site scripting attacks when an administrator views the logs in the Admin Portal."}, {"lang": "es", "value": "Una vulnerabilidad en el componente logging en Cisco Identity Services Engine podr\u00eda permitir que un atacante remoto no autenticado lleve a cabo ataques Cross-Site Scripting (XSS). La vulnerabilidad se debe a la validaci\u00f3n incorrecta de las peticiones almacenadas en la base de datos del sistema. Un atacante podr\u00eda explotar esta vulnerabilidad mediante el env\u00edo de peticiones maliciosas al sistema objetivo. Su explotaci\u00f3n con \u00e9xito podr\u00eda permitir que el atacante lleve a cabo ataques de Cross-Site Scripting (XSS) cuando un administrador visualiza los archivos de registro en el portal de administrador."}], "lastModified": "2019-10-09T23:35:40.343", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cisco:identity_services_engine:2.2\\(0.910\\):*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7F634714-4EC3-4741-8A14-2C8500A6C09E"}, {"criteria": "cpe:2.3:a:cisco:identity_services_engine:2.3\\(0.905\\):*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3C7FFDEB-EEC6-4EA8-9F22-5F33EE280AD2"}, {"criteria": "cpe:2.3:a:cisco:identity_services_engine:2.4\\(0.903\\):*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D761979F-0390-4DC6-B3AC-63F953FA6B37"}], "operator": "OR"}]}], "sourceIdentifier": "ykramarz@cisco.com"}