Test ID:	1.3.6.1.4.1.25623.1.0.105471
Category:	CISCO
Title:	Cisco Identity Services Engine Multiple Cross Site Scripting Vulnerabilities
Summary:	A vulnerability in the web framework of Cisco Identity Services Engine could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web interface on the affected system.
Description:	Summary: A vulnerability in the web framework of Cisco Identity Services Engine could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web interface on the affected system. Vulnerability Insight: The vulnerability is due to insufficient input validation on several web pages. An attacker could exploit this vulnerability by persuading a user to access a malicious link. Vulnerability Impact: An unauthenticated, remote attacker could exploit this vulnerability to execute arbitrary script or HTML code in the user's browser in the security context of the affected application. This action could allow the attacker to steal sensitive browser-based information, including authentication cookies and recently submitted data, or to take actions on the site as the affected user. Solution: See vendor advisory for a solution CVSS Score: 4.3 CVSS Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Cross-Ref:	BugTraq ID: 72083 Common Vulnerability Exposure (CVE) ID: CVE-2014-8022 http://www.securityfocus.com/bid/72083 Cisco Security Advisory: 20150115 Cisco Identity Services Engine Cross-Site Scripting Vulnerability http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-8022 Cisco Security Advisory: 20150128 Cisco Identity Services Engine Cross-Site Scripting Vulnerability https://tools.cisco.com/security/center/viewAlert.x?alertId=37045 http://www.securitytracker.com/id/1031560 XForce ISS Database: cisco-ises-cve20148022-xss(100664) https://exchange.xforce.ibmcloud.com/vulnerabilities/100664
Copyright	This script is Copyright (C) 2015 Greenbone Networks GmbH

This is only one of 99761 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.