CVE-2022-20967

A vulnerability in the web-based management interface of Cisco Identity Services Engine could allow an authenticated, remote attacker to conduct cross-site scripting attacks against other users of the application web-based management interface. This vulnerability is due to improper validation of input to an application feature before storage within the web-based management interface. An attacker could exploit this vulnerability by creating entries within the application interface that contain malicious HTML or script code. A successful exploit could allow the attacker to store malicious HTML or script code within the application interface for use in further cross-site scripting attacks. Cisco has not yet released software updates that address this vulnerability.

CVSS v3 5.4 MEDIUM

5.4^/10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.3 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-7Q4TNYUx	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:cisco:identity_services_engine::::::::
	cpe:2.3:a:cisco:identity_services_engine:2.6.0:-::::::
	cpe:2.3:a:cisco:identity_services_engine:2.6.0:patch1::::::
	cpe:2.3:a:cisco:identity_services_engine:2.6.0:patch10::::::
	cpe:2.3:a:cisco:identity_services_engine:2.6.0:patch11::::::
	cpe:2.3:a:cisco:identity_services_engine:2.6.0:patch12::::::
	cpe:2.3:a:cisco:identity_services_engine:2.6.0:patch2::::::
	cpe:2.3:a:cisco:identity_services_engine:2.6.0:patch3::::::
	cpe:2.3:a:cisco:identity_services_engine:2.6.0:patch5::::::
	cpe:2.3:a:cisco:identity_services_engine:2.6.0:patch6::::::
	cpe:2.3:a:cisco:identity_services_engine:2.6.0:patch7::::::
	cpe:2.3:a:cisco:identity_services_engine:2.6.0:patch8::::::
	cpe:2.3:a:cisco:identity_services_engine:2.6.0:patch9::::::
	cpe:2.3:a:cisco:identity_services_engine:2.7.0:-::::::
	cpe:2.3:a:cisco:identity_services_engine:2.7.0:patch1::::::
	cpe:2.3:a:cisco:identity_services_engine:2.7.0:patch2::::::
	cpe:2.3:a:cisco:identity_services_engine:2.7.0:patch3::::::
	cpe:2.3:a:cisco:identity_services_engine:2.7.0:patch4::::::
	cpe:2.3:a:cisco:identity_services_engine:2.7.0:patch5::::::
	cpe:2.3:a:cisco:identity_services_engine:2.7.0:patch6::::::
	cpe:2.3:a:cisco:identity_services_engine:2.7.0:patch7::::::
	cpe:2.3:a:cisco:identity_services_engine:3.0.0:-::::::
	cpe:2.3:a:cisco:identity_services_engine:3.0.0:patch1::::::
	cpe:2.3:a:cisco:identity_services_engine:3.0.0:patch2::::::
	cpe:2.3:a:cisco:identity_services_engine:3.0.0:patch3::::::
	cpe:2.3:a:cisco:identity_services_engine:3.0.0:patch4::::::
	cpe:2.3:a:cisco:identity_services_engine:3.0.0:patch5::::::
	cpe:2.3:a:cisco:identity_services_engine:3.0.0:patch6::::::
	cpe:2.3:a:cisco:identity_services_engine:3.1:-::::::
	cpe:2.3:a:cisco:identity_services_engine:3.1:patch1::::::
	cpe:2.3:a:cisco:identity_services_engine:3.1:patch3::::::
	cpe:2.3:a:cisco:identity_services_engine:3.1:patch4::::::
	cpe:2.3:a:cisco:identity_services_engine:3.2:-::::::

History

25 Jan 2024, 17:15

Type	Values Removed	Values Added
References	{'url': 'https://yoroi.company/en/research/cve-advisory-full-disclosure-cisco-ise-multiple-vulnerabilities-rce-with-1-click/', 'name': 'https://yoroi.company/en/research/cve-advisory-full-disclosure-cisco-ise-multiple-vulnerabilities-rce-with-1-click/', 'tags': [], 'refsource': ''}

16 Jan 2024, 22:15

Type	Values Removed	Values Added
References		() https://yoroi.company/en/research/cve-advisory-full-disclosure-cisco-ise-multiple-vulnerabilities-rce-with-1-click/ -

07 Nov 2023, 03:43

Type	Values Removed	Values Added
Summary	A vulnerability in the web-based management interface of Cisco Identity Services Engine could allow an authenticated, remote attacker to conduct cross-site scripting attacks against other users of the application web-based management interface. This vulnerability is due to improper validation of input to an application feature before storage within the web-based management interface. An attacker could exploit this vulnerability by creating entries within the application interface that contain malicious HTML or script code. A successful exploit could allow the attacker to store malicious HTML or script code within the application interface for use in further cross-site scripting attacks. Cisco has not yet released software updates that address this vulnerability.	A vulnerability in the web-based management interface of Cisco Identity Services Engine could allow an authenticated, remote attacker to conduct cross-site scripting attacks against other users of the application web-based management interface. This vulnerability is due to improper validation of input to an application feature before storage within the web-based management interface. An attacker could exploit this vulnerability by creating entries within the application interface that contain malicious HTML or script code. A successful exploit could allow the attacker to store malicious HTML or script code within the application interface for use in further cross-site scripting attacks. Cisco has not yet released software updates that address this vulnerability.

Information

Published : 2023-01-20 07:15

Updated : 2024-02-28 19:51

NVD link : CVE-2022-20967

Mitre link : CVE-2022-20967

CVE.ORG link : CVE-2022-20967

JSON object : View

Products Affected

cisco

identity_services_engine

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

5.4 /10