Vulnerability   
Search   
    Search 219043 CVE descriptions
and 99761 test descriptions,
access 10,000+ cross references.
Tests   CVE   All  

Test ID:1.3.6.1.4.1.25623.1.0.105471
Category:CISCO
Title:Cisco Identity Services Engine Multiple Cross Site Scripting Vulnerabilities
Summary:A vulnerability in the web framework of Cisco Identity Services Engine could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web interface on the affected system.
Description:Summary:
A vulnerability in the web framework of Cisco Identity Services Engine could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web interface on the affected system.

Vulnerability Insight:
The vulnerability is due to insufficient input validation on several web pages. An attacker could exploit this vulnerability by persuading a user to access a malicious link.

Vulnerability Impact:
An unauthenticated, remote attacker could exploit this vulnerability to execute arbitrary script or HTML code in the user's browser in the security context of the affected application. This action could allow the attacker to steal sensitive browser-based information, including authentication cookies and recently submitted data, or to take actions on the site as the affected user.

Solution:
See vendor advisory for a solution

CVSS Score:
4.3

CVSS Vector:
AV:N/AC:M/Au:N/C:N/I:P/A:N

Cross-Ref: BugTraq ID: 72083
Common Vulnerability Exposure (CVE) ID: CVE-2014-8022
http://www.securityfocus.com/bid/72083
Cisco Security Advisory: 20150115 Cisco Identity Services Engine Cross-Site Scripting Vulnerability
http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-8022
Cisco Security Advisory: 20150128 Cisco Identity Services Engine Cross-Site Scripting Vulnerability
https://tools.cisco.com/security/center/viewAlert.x?alertId=37045
http://www.securitytracker.com/id/1031560
XForce ISS Database: cisco-ises-cve20148022-xss(100664)
https://exchange.xforce.ibmcloud.com/vulnerabilities/100664
CopyrightThis script is Copyright (C) 2015 Greenbone Networks GmbH

This is only one of 99761 vulnerability tests in our test suite. Find out more about running a complete security audit.

To run a free test of this vulnerability against your system, register below.




© 1998-2024 E-Soft Inc. All rights reserved.